1

I'd like to list a directory on my server by using my web browser. The directory is /srv/downloads/

I installed nginx server to do that. Here is the configuration files:

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

and the .conf file inside the conf.d directory is:

server {
    listen       80 default_server;
    server_name  example.org;
    root     /srv;

    client_max_body_size 64M;

    location /downloads/ {
    autoindex on;
        alias /srv/downloads/;
    allow 192.168.0.0/24;
    allow 10.212.116.0/23;
    deny all;
    }
}

But when I try to access http://192.168.0.2/downloads/, I am able to list directories but not everything. Below is what happens :

2015/04/21 17:08:54 [crit] 12839#0: *1 stat() "/srv/downloads/fix_kernel_doc.patch.done" failed (13: Permission denied), client: 192.168.0.26, server: example.org, request: "GET /downloads/ HTTP/1.1", host: "192.168.0.2"

As shown in the nginx.conf, nginx server is ran by the user "nginx". So I did the following:

[root@srv]# su -l nginx -s /bin/stat /srv/downloads/fix_kernel_doc.patch.done
Last login: mar. avril 21 17:30:19 CEST 2015 on pts/0
  File: '/srv/downloads/fix_kernel_doc.patch.done'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: fd00h/64768d    Inode: 85524762    Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/    is)   Gid: ( 1000/    devs)
Context: system_u:object_r:var_t:s0
Access: 2015-04-21 17:22:48.393259661 +0200
Modify: 2015-04-21 17:22:48.393259661 +0200
Change: 2015-04-21 17:22:48.393259661 +0200
 Birth: -

My user nginx is in the "devs" group. I also tried with the user www-data just to be sure but it's not working neither.

Any idea please ? Thanks

2 Answers 2

1

Based on the Context: system_u:object_r:var_t:s0, I'm guessing you're using SELinux.

SELinux might be blocking the access. To verify that is an SELinux issue, try running setenforce 0 to temporarily disable SElinux, and retry loading the directory. Alternatively, /var/log/audit/audit.log should have logged the denial if one did occur.

If that works, you're going to have to change the context of the directory to allow nginx to read it, or try running audit2allow to see if there's a SELinux boolean you can change to allow nginx access.

Edit: Since it is SELinux, and a single folder, the easiest way to fix this should be to run semanage fcontext -a -t httpd_sys_content_t "/srv(/.*)?" followed by restorecon -R -v /srv.

The first one tells SELinux that the /srv directory contains read-only content for a HTTP server, the second one will go through and relabel all the files properly.

Finally, re-enable SELinux with setenforce 1.

Instructions from http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/, https://drupalwatchdog.com/volume-2/issue-2/using-apache-and-selinux-together and http://www.techrepublic.com/blog/linux-and-open-source/practical-selinux-for-the-beginner-contexts-and-labels/

Configure SELinux access so that Apache can access mounted directories is a related question.

2
  • Indeed, disabling SELinux helps me to get the whole content of the directory and its subdirectories. The problem with the user nginx is to get the attributes of the files. type=AVC msg=audit(1429687617.608:30874): avc: denied { getattr } for pid=12839 comm="nginx" path="/srv/downloads/gdk-pixbuf-2.30.8.tar.xz" dev="dm-0" ino=75184977 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
    – Lazao
    Apr 22, 2015 at 6:28
  • I edited my answer to include the commands which should do what you want, hopefully they work!
    – Kyle
    Apr 22, 2015 at 6:58
1

I have had this problem and am commenting this for documentation purpose.

Example:

nginx user: www-data

    location /sub {
            alias /home/dir1/dir2/dir3;
            autoindex on;
    }

setting r+x for www-data as group owner for dir3 returns permission denied

setting r+x for www-data as group owner for dir2 returns the wanted behaviour

rights being set with the recursive option

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.