Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am getting some quirky permissions errors with apache, I can access documents under by apache home directory but not under any other directory.

When I view my Apache error_log it shows

[error] (13)Permission denied: access to / denied

I have file and folder permission set to 777 and I know my httpd.conf is setup correctly.

Here is the odd thing

when I execute this for a file in apache's directory it works fine

su -s /bin/bash -c "cat /usr/local/apache2/htdocs/index.html" apache
<html><body><h1>It works!</h1></body></html>

When I execute this for an outside file with the same permissions I get

su -s /bin/bash -c "cat /var/www/html/index.html" apache
cat: /var/www/html/index.html: Permission denied

I thought this must be an selinux thing so I turned that off by setting SELINUX=disabled in /etc/selinux/config and restarting the server but that didn't work.

I am using a fresh install of CentOS 4.8 and my web directories are rsync'ed over from my primary web server.

Update

 ls -lZ
Sorry, this option can only be used on a SELinux kernel.

 id apache
uid=48(apache) gid=48(apache) groups=48(apache)

ls -l /var /var/www /var/www/html /var/www/html/index.html

-rwxrwxrwx   1 apache apache    7 Jan 18 15:36 /var/www/html/index.html

/var:
total 192
drwxr-xr-x   2 root    root    4096 Dec 28 09:04 account
drwxr-xr-x   9 root    root    4096 Dec 28 09:04 cache
drwxr-xr-x   3 netdump netdump 4096 Dec 28 09:04 crash
drwxr-xr-x   3 root    root    4096 Dec 28 09:04 db
drwxr-xr-x   2 root    root    4096 Dec 29 13:31 doc
drwxr-xr-x   3 root    root    4096 Dec 28 09:04 empty
drwxr-xr-x   3 root    root    4096 Dec 28 09:06 ftp
drwxr-xr-x   7 root    root    4096 Jan 15 10:24 httpdocs
drwxr-xr-x   7 root    root    4096 Dec 29 13:31 installed_packages
drwxr-xr-x  24 root    root    4096 Jan  4 09:54 lib
drwxr-xr-x   2 root    root    4096 Feb 21  2005 local
drwxrwxr-x   6 root    lock    4096 Jan 19 04:02 lock
drwxr-xr-x  12 root    root    4096 Jan 19 07:50 log
lrwxrwxrwx   1 root    root      10 Dec 28 09:03 mail -> spool/mail
drwxr-x---   5 root    named   4096 Jul 29 14:10 named
drwxr-xr-x   2 root    root    4096 Feb 21  2005 nis
drwxr-xr-x   2 root    root    4096 Feb 21  2005 opt
drwxr-xr-x   2 root    root    4096 Feb 21  2005 preserve
drwxr-xr-x  22 root    root    4096 Jan 19 07:44 run
drwxr-xr-x  14 root    root    4096 Dec 28 09:04 spool
drwxrwxrwt   2 root    root    4096 Jan 15 04:30 tmp
drwx------   2 root    root    4096 Feb 21  2005 tux
drwxr-xr-x   8 root    root    4096 Nov 12 05:56 www
drwxr-xr-x   2 root    root    4096 Jan 19 10:26 www2
drwxr-xr-x   3 root    root    4096 Dec 28 09:04 yp

/var/www:
total 48
drwxr-xr-x   2 root      root 4096 Nov 12 05:56 cgi-bin
drwxr-xr-x   3 root      root 4096 Dec 28 09:16 error
drwxr-xr-x   2 root      root 4096 Jan 18 15:36 html
drwxr-xr-x   3 root      root 4096 Dec 28 09:16 icons
drwxr-xr-x  13 root      root 4096 Dec 28 09:16 manual
drwxr-xr-x   2 webalizer root 4096 Jan 19 04:02 usage

/var/www/html:
total 8
-rwxrwxrwx  1 apache apache 7 Jan 18 15:36 index.html
share|improve this question
    
have you double checked selinux in your running system? can you show the output of ls -lZ from both files? what says getenforce? –  Christian Jan 19 '10 at 16:36
    
Can you provide the output of the following two commands? id apache ls -l /var /var/www /var/www/html /var/www/html/index.html –  baumgart Jan 19 '10 at 16:57
    
updated post to include additional commands –  James Hackett Jan 19 '10 at 17:59
    
Oops - I meant 'ls -ld /var .../index.html', but I got what I wanted. That's strange...what happens if you actually become the user - don't just use 'su -c', try '/bin/su - apache' and then cat the file. And if that doesn't work, as apache try to do 'ls -ld / /var /var/www ...'. It's strange - the permissions look ok...I'm not seeing an issue. –  baumgart Jan 19 '10 at 18:51

2 Answers 2

up vote 0 down vote accepted

From what you've posted I'd say you need to give apache permissions to access /var.

share|improve this answer
    
wow, you are right! This was one thing I did not notice or check. Some how I got 700 on /var (I guess it must been a mistyped rsync command?), I can't believe I haven't had any other problems. –  James Hackett Jan 19 '10 at 19:26
    
Most of the other stuff is probably running as root. Had I asked you to run the right command the first time, we would have seen that. –  baumgart Jan 19 '10 at 19:43

[error] (13)Permission denied: access to / denied

A CGI or plugin may be trying to create a file in /. See if you can track down exactly what operation is creating the error.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.