File with same owner, group and less strict permissions can't be opened by nginx

Question

I'm getting a permission denied error on an index.php file of a site running on Nginx. The error is below:

2018/01/19 05:50:01 [error] 9664#9664: *17 FastCGI sent in stderr: "PHP message:
PHP Warning:  Unknown: failed to open stream: Permission denied in Unknown on line 0
Unable to open primary script: /var/www/the-site/index.php (Permission denied)" while
reading response header from upstream, client: xxx.xxx.xxx.xxx,
server: www.the-site.com, request: "GET /index.php HTTP/1.1",
upstream: "fastcgi://unix:/var/run/php5-fpm-the-site.sock:", host: "www.the-site.com"

Permissions on the file are

-rw-rw-r--. 1 root root 418 Aug  2 17:49 index.php

Changing the file permissions to 777 (temporarily) does not help:

-rwxrwxrwx.  1 root root   418 Aug  2 17:49 index.php

However, if I move the file:

mv index.php index-old.php

and replace it with a new index.php with the following content:

<?php phpinfo(); ?>

then that works fine. The user and group are the same, and the permissions are now weaker:

$ ls -l index*
-rwxrwxrwx. 1 root root 418 Aug  2 17:49 index-old.php
-rw-r--r--. 1 root root  20 Jan 19 05:56 index.php

Here's the result of ls -Z:

$ ls -Z index*
-rwxrwxrwx. root root unconfined_u:object_r:user_tmp_t:s0 index-old.php
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.php

Answer 1

-rw-r--r--. 1 root root  20 Jan 19 05:56 index.php
          ^ this one

The dot after the permission bits indicates a SELinux security context. If you're running a SELinux system, it would need to match so that nginx can read the file. You can use ls -Z to view the security context, and restorecon to restore the default security context (based on the file location, I think), or chcon to change it.

Something like this

$ restorecon /var/www/the-site/index.php

or this for the full directory.

$ restorecon -r /var/www/the-site

(I can't test that anywhere now, check the syntax)

See, e.g. the Red Hat documentation on SELinux labels.