2

I'm getting a permission denied error on an index.php file of a site running on Nginx. The error is below:

2018/01/19 05:50:01 [error] 9664#9664: *17 FastCGI sent in stderr: "PHP message:
PHP Warning:  Unknown: failed to open stream: Permission denied in Unknown on line 0
Unable to open primary script: /var/www/the-site/index.php (Permission denied)" while
reading response header from upstream, client: xxx.xxx.xxx.xxx,
server: www.the-site.com, request: "GET /index.php HTTP/1.1",
upstream: "fastcgi://unix:/var/run/php5-fpm-the-site.sock:", host: "www.the-site.com"

Permissions on the file are

-rw-rw-r--. 1 root root 418 Aug  2 17:49 index.php

Changing the file permissions to 777 (temporarily) does not help:

-rwxrwxrwx.  1 root root   418 Aug  2 17:49 index.php

However, if I move the file:

mv index.php index-old.php

and replace it with a new index.php with the following content:

<?php phpinfo(); ?>

then that works fine. The user and group are the same, and the permissions are now weaker:

$ ls -l index*
-rwxrwxrwx. 1 root root 418 Aug  2 17:49 index-old.php
-rw-r--r--. 1 root root  20 Jan 19 05:56 index.php

Here's the result of ls -Z:

$ ls -Z index*
-rwxrwxrwx. root root unconfined_u:object_r:user_tmp_t:s0 index-old.php
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.php
  • 2
    SELinux problems? – muru Jan 19 '18 at 11:11
  • Thanks for the hint. I've edited my question. Turns out there is a difference. How do I resolve this? I'm not particularly averse to just disabling it, but if there's an easy way that means I don't have to do that then great. – Michael Jan 19 '18 at 11:23
5
-rw-r--r--. 1 root root  20 Jan 19 05:56 index.php
          ^ this one

The dot after the permission bits indicates a SELinux security context. If you're running a SELinux system, it would need to match so that nginx can read the file. You can use ls -Z to view the security context, and restorecon to restore the default security context (based on the file location, I think), or chcon to change it.

Something like this

$ restorecon /var/www/the-site/index.php

or this for the full directory.

$ restorecon -r /var/www/the-site

(I can't test that anywhere now, check the syntax)

See, e.g. the Red Hat documentation on SELinux labels.

  • Thanks! I've just disabled it for now and that appears to have fixed it. – Michael Jan 19 '18 at 11:37
  • 1
    @Michael, I would recommend taking another look at restorecon to fix it, so you don't need to completely disable SELinux – ilkkachu Jan 19 '18 at 11:42
  • 1
    Another option is to use audit2allow to pipe the output of the audit log through a SELinux context profile – Raman Sailopal Jan 19 '18 at 11:45
  • 1
    @ilkkachu Yeah, I will. This (somehow) happened on a live site so my first priority was just to get it working again. – Michael Jan 19 '18 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.