0

My current configuration:

GCE f1-micro (1 vCPU, 0.6GB) Haswell, CentOS 7.2, NGINX 1.10.2, PHP 7.0.12

  • Static pages serve without issue.
  • phpinfo() page servers without issue.
  • WordPress setup page overloads CPU causing me to reset the server.

[error] 29111#0: *43 FastCGI sent in stderr: "PHP message: PHP Warning: Unknown: failed to open stream: Permission denied in Unknown on line 0

Unable to open primary script: /var/www/mysite.com/public/index.php (Permission denied)" while reading response header from upstream, client: XX.XXX.XXX.XXX, server: _, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock:", host: "XXX.XXX.XXX.XXX"

NGINX *.conf file location directives

location / {
    try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
    try_files                  $uri =404;
    fastcgi_split_path_info    ^(.+\.php)(/.+)$;
    fastcgi_pass               unix:/var/run/php-fpm/php-fpm.sock;
    fastcgi_index              index.php;
    include                    /etc/nginx/fastcgi.conf;
}
location ~ ^/(status|ping)$ {
    access_log off;
    include                    /etc/nginx/fastcgi.conf;
    fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
}

NGINX

user = rocky

PHP-FPM

user = rocky

group = rocky

listen.owner = rocky

listen.group = rocky

listen.mode = 0660

Public permissions

/var/

drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 www

/var/www/

drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 mydomain

/var/www/mydomain/

drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 public

/var/www/mydomain/public

-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 index.html
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 index.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 info.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 license.txt
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 readme.html
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-activate.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-admin
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-blog-header.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-comments-post.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-config-sample.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-content
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-cron.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-includes
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-links-opml.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-load.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-login.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-mail.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-settings.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-signup.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-trackback.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 xmlrpc.php

Audit Log

type=SYSCALL msg=audit(1480104445.879:461): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=10000 a2=7 a3=22 items=0 ppid=1270 pid=1275 auid=4294967295 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)

type=AVC msg=audit(1480104445.879:461): avc: denied { execmem } for pid=1275 comm="php-fpm" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=process

8
  • You haven't really described your problem well. "setup page overloads CPU causing me to reset the server" is quite ambiguous. You need to reboot the server? You need to restart the PHP process? What process takes CPU? What does the PHP and Wordpress error log say? You may have to enable Wordpress debugging and debug log file (they're separate config file entries). This sounds quite easily solvable once all information is known. Could be permissions as suggested above.
    – Tim
    Nov 25, 2016 at 18:35
  • Hm, the permissions you've posted look OK. Check the audit log to see if any AVC denials are logged. Nov 25, 2016 at 18:45
  • @MichaelHampton Audit log appended. Also, nowhere in my LEMP setup do I address anon_hugepage. Nov 25, 2016 at 19:00
  • That's not the audit log, it's a summary. You need to look at the specific log entries. Nov 25, 2016 at 19:05
  • @MichaelHampton I've appended the recent Audit Log output via pastebin link. Nov 25, 2016 at 20:16

1 Answer 1

0

The issue was SELinux. I resolved the issue by allowing httpd access to execmem.

setsebool -P httpd_execmem 1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .