7

I have nginx running on my CentOS 7 machine. Every day I run a cron job that generates new Diffie-Hellman parameters. They are saved in /etc/ssl/dh/dhparam.pem. But SELinux is preventing nginx from reading this file.

This is the line in the nginx error log:

nginx[3189]: nginx: [emerg] BIO_new_file("/etc/ssl/dh/dhparam.pem") failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/ssl/dh/dhparam.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib)

This is the audit log:

type=AVC msg=audit(1473285202.181:334): avc:  denied  { open } for  pid=1393 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473285832.647:743): avc:  denied  { open } for  pid=2958 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287010.821:803): avc:  denied  { open } for  pid=3083 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646316 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287142.871:826): avc:  denied  { open } for  pid=3118 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287172.480:843): avc:  denied  { open } for  pid=3134 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287681.994:866): avc:  denied  { open } for  pid=3189 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file

I'm not very familiar with SELinux (I know I should learn that): How can I grant nginx access without disabeling SELinux (or setting it to permissive)?

2
  • 2
  • Hi, thanks for the link. It works! Indeed I'm creating a temporary file and then move it. So I will mmodify my cron job to cp the file and delete the temp file. Thanks for the hint! Can you post your comment as an answer so I can accept it?
    – LuMa
    Sep 8, 2016 at 0:41

1 Answer 1

11

SELinux is denying you access to the file, since you moved instead of copied it from somewhere else on the filesystem into its final location. Thus it kept its original security context, which didn't allow Apache to access it.

To resolve the issue, relabel the file with restorecon.

To avoid the problem in future, copy files (and delete the original if necessary), or use mv -Z.

1
  • 1
    Wow. Wow! I am so glad other people ran into this problem before I did and spent their time - thank goodness for Stack Exchange. This was the exact problem, and this answer had the exact cause and solution. Nov 8, 2018 at 20:58

Not the answer you're looking for? Browse other questions tagged .