0

My current configuration:

GCE f1-micro (1 vCPU, 0.6GB) Haswell, CentOS 7.2, NGINX 1.10.2, PHP 7.0.12

  • Static pages serve without issue.
  • phpinfo() page servers without issue.
  • WordPress setup page overloads CPU causing me to reset the server.

[error] 29111#0: *43 FastCGI sent in stderr: "PHP message: PHP Warning: Unknown: failed to open stream: Permission denied in Unknown on line 0

Unable to open primary script: /var/www/mysite.com/public/index.php (Permission denied)" while reading response header from upstream, client: XX.XXX.XXX.XXX, server: _, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock:", host: "XXX.XXX.XXX.XXX"

NGINX *.conf file location directives

location / {
    try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
    try_files                  $uri =404;
    fastcgi_split_path_info    ^(.+\.php)(/.+)$;
    fastcgi_pass               unix:/var/run/php-fpm/php-fpm.sock;
    fastcgi_index              index.php;
    include                    /etc/nginx/fastcgi.conf;
}
location ~ ^/(status|ping)$ {
    access_log off;
    include                    /etc/nginx/fastcgi.conf;
    fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
}

NGINX

user = rocky

PHP-FPM

user = rocky

group = rocky

listen.owner = rocky

listen.group = rocky

listen.mode = 0660

Public permissions

/var/

drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 www

/var/www/

drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 mydomain

/var/www/mydomain/

drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 public

/var/www/mydomain/public

-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 index.html
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 index.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 info.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 license.txt
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 readme.html
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-activate.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-admin
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-blog-header.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-comments-post.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-config-sample.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-content
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-cron.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-includes
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-links-opml.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-load.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-login.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-mail.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-settings.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-signup.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-trackback.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 xmlrpc.php

Audit Log

type=SYSCALL msg=audit(1480104445.879:461): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=10000 a2=7 a3=22 items=0 ppid=1270 pid=1275 auid=4294967295 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)

type=AVC msg=audit(1480104445.879:461): avc: denied { execmem } for pid=1275 comm="php-fpm" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=process

  • You haven't really described your problem well. "setup page overloads CPU causing me to reset the server" is quite ambiguous. You need to reboot the server? You need to restart the PHP process? What process takes CPU? What does the PHP and Wordpress error log say? You may have to enable Wordpress debugging and debug log file (they're separate config file entries). This sounds quite easily solvable once all information is known. Could be permissions as suggested above. – Tim Nov 25 '16 at 18:35
  • Hm, the permissions you've posted look OK. Check the audit log to see if any AVC denials are logged. – Michael Hampton Nov 25 '16 at 18:45
  • @MichaelHampton Audit log appended. Also, nowhere in my LEMP setup do I address anon_hugepage. – Ryan Prentiss Nov 25 '16 at 19:00
  • That's not the audit log, it's a summary. You need to look at the specific log entries. – Michael Hampton Nov 25 '16 at 19:05
  • @MichaelHampton I've appended the recent Audit Log output via pastebin link. – Ryan Prentiss Nov 25 '16 at 20:16
0

The issue was SELinux. I resolved the issue by allowing httpd access to execmem.

setsebool -P httpd_execmem 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.