I have nginx running on my CentOS 7 machine. Every day I run a cron job that generates new Diffie-Hellman parameters. They are saved in /etc/ssl/dh/dhparam.pem
. But SELinux is preventing nginx from reading this file.
This is the line in the nginx error log:
nginx[3189]: nginx: [emerg] BIO_new_file("/etc/ssl/dh/dhparam.pem") failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/ssl/dh/dhparam.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib)
This is the audit log:
type=AVC msg=audit(1473285202.181:334): avc: denied { open } for pid=1393 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473285832.647:743): avc: denied { open } for pid=2958 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287010.821:803): avc: denied { open } for pid=3083 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646316 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287142.871:826): avc: denied { open } for pid=3118 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287172.480:843): avc: denied { open } for pid=3134 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287681.994:866): avc: denied { open } for pid=3189 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
I'm not very familiar with SELinux (I know I should learn that): How can I grant nginx access without disabeling SELinux (or setting it to permissive)?