1

I've been trying to debug this for the last few hours and, having solved so many issues already, I seem to have hit a brick wall

I have a Wordpress install using nginx under CentOS7 (AWS Lightsail if that matters). For this I have ensured

  • wp-content/uploads directory is 766
  • the directory owned by apache:apache and both nginx and php-fpm run under that user
  • seLinux is httpd_sys_rw_content_t for the directory

That got me as far as uploading files successfully. It creates the file and the above permissions propagate properly (ln -Z and running stat as the apache user). Files are 666, but 766 doesn't seem to change anything. The older files I manually put up serve properly. The only difference I can find is the manually uploaded files are set in seLinux as

Context: unconfined_u:object_r:httpd_sys_rw_content_t:s0

While the new 403 file is

Context: system_u:object_r:httpd_sys_rw_content_t:s0

I tried setenforce 0 but no change. Restarted nginx as well and still no change. Logged error is

2019/05/19 22:35:06 [error] 21393#0: *4010 open() "/usr/share/nginx/example/wp-content/uploads/2019/05/file.jpg" failed (13: Permission denied), client: 172.69.44.142, server: example.com, request: "GET /wp-content/uploads/2019/05/file.jpg HTTP/1.1", host: "www.example.com"

Yet /usr/share/nginx/example/wp-content/uploads/2019/04/another_file.jpg works fine, so it doesn't seem related to the nginx config either.

Is there something else I'm missing?

1

Fix the permissions. 766 is not a valid mode for a directory, at least not if you want to access the files within it.

  • Couple of problems, though. 1. The other working directories are just fine with 766. 2. Neither 755, nor 644, nor 777 fixes the problem. I have noted if I SCP new files into those directories, they don't work either – Machavity May 20 at 2:51
  • OK, well, you have even more serious permission problems than you let on initially. Fix them all. – Michael Hampton May 20 at 6:02
  • Turns out 755 was the answer after all. Cloudflare was caching things, which was confusing. I bypassed it and was able to figure that out finally. – Machavity May 23 at 1:26
  • @Machavity I suppose 777 is the same as 755 + 022, not really understand why it doesn't work. BTW, the top Google search for SELinux is how to disable it. – iBug Jun 9 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.