1

I've been trying to debug this for the last few hours and, having solved so many issues already, I seem to have hit a brick wall

I have a Wordpress install using nginx under CentOS7 (AWS Lightsail if that matters). For this I have ensured

  • wp-content/uploads directory is 766
  • the directory owned by apache:apache and both nginx and php-fpm run under that user
  • seLinux is httpd_sys_rw_content_t for the directory

That got me as far as uploading files successfully. It creates the file and the above permissions propagate properly (ln -Z and running stat as the apache user). Files are 666, but 766 doesn't seem to change anything. The older files I manually put up serve properly. The only difference I can find is the manually uploaded files are set in seLinux as

Context: unconfined_u:object_r:httpd_sys_rw_content_t:s0

While the new 403 file is

Context: system_u:object_r:httpd_sys_rw_content_t:s0

I tried setenforce 0 but no change. Restarted nginx as well and still no change. Logged error is

2019/05/19 22:35:06 [error] 21393#0: *4010 open() "/usr/share/nginx/example/wp-content/uploads/2019/05/file.jpg" failed (13: Permission denied), client: 172.69.44.142, server: example.com, request: "GET /wp-content/uploads/2019/05/file.jpg HTTP/1.1", host: "www.example.com"

Yet /usr/share/nginx/example/wp-content/uploads/2019/04/another_file.jpg works fine, so it doesn't seem related to the nginx config either.

Is there something else I'm missing?

1 Answer 1

1

Fix the permissions. 766 is not a valid mode for a directory, at least not if you want to access the files within it.

4
  • Couple of problems, though. 1. The other working directories are just fine with 766. 2. Neither 755, nor 644, nor 777 fixes the problem. I have noted if I SCP new files into those directories, they don't work either
    – Machavity
    May 20, 2019 at 2:51
  • OK, well, you have even more serious permission problems than you let on initially. Fix them all. May 20, 2019 at 6:02
  • Turns out 755 was the answer after all. Cloudflare was caching things, which was confusing. I bypassed it and was able to figure that out finally.
    – Machavity
    May 23, 2019 at 1:26
  • @Machavity I suppose 777 is the same as 755 + 022, not really understand why it doesn't work. BTW, the top Google search for SELinux is how to disable it.
    – iBug
    Jun 9, 2019 at 16:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .