SELinux is preventing nginx from write access on the Unicorn socket

Question

I'm trying to setup my Rails application with Nginx and Unicorn.

Nginx throws following error by accessing root url of my Rails-app:

дек 14 23:39:42 servercentos7 python[5604]: SELinux is preventing /usr/sbin/nginx from write access on the sock_file /var/www/amily_photo/shared/tmp/sockets/unicorn.sock.

                                           *****  Plugin catchall (100. confidence) suggests   **************************

                                           If you believe that nginx should be allowed write access on the unicorn.sock sock_file by default.
                                           Then you should report this as a bug.
                                           You can generate a local policy module to allow this access.
                                           Do
                                           allow this access for now by executing:
                                           # grep nginx /var/log/audit/audit.log | audit2allow -M mypol
                                           # semodule -i mypol.pp

I've executed two commands, mentioned in error report, but it does't works

grep nginx /var/log/audit/audit.log | audit2allow -M mypol
semodule -i mypol.pp

nginx.conf:

worker_processes 1;

user root root; # for systems with a "nogroup"

# Feel free to change all paths to suite your needs here, of course
pid /tmp/nginx.pid;
error_log /tmp/nginx.error.log;

events {
  worker_connections 1024; # increase if you have lots of clients
  accept_mutex off; # "on" if nginx worker_processes > 1
  # use epoll; # enable for Linux 2.6+
  # use kqueue; # enable for FreeBSD, OSX
}

http {
  # nginx will find this file in the config directory set at nginx build time
  include mime.types;

  # fallback in case we can't determine a type
  default_type application/octet-stream;

  # click tracking!
  access_log /tmp/nginx.access.log combined;

  sendfile on;

  tcp_nopush on; # off may be better for *some* Comet/long-poll stuff
  tcp_nodelay off; # on may be better for some Comet/long-poll stuff

  gzip on;
  gzip_http_version 1.0;
  gzip_proxied any;
  gzip_min_length 500;
  gzip_disable "MSIE [1-6]\.";
  gzip_types text/plain text/html text/xml text/css
             text/comma-separated-values
             text/javascript application/x-javascript
             application/atom+xml;

  include /etc/nginx/sites-enabled/*;

  ##########################################################
  # Catch all requests to server ip so just hitting the ip
  # won't render anything.
  ##########################################################
  server {
    listen   80 default;
    server_name  everythingelse;

    # Everything is a 404
    location / {
      return 404;
    }
  }
}

Nginx config for application:

##############################################################
# Upstream must have unique name and unique socket.          #
# The socket must match what is in the app's unicorn.rb file #
##############################################################
upstream amily_photo_server {
  server unix:/tmp/unicorn_amily_photo.sock fail_timeout=0;
}

##############################
# Server configs go here     #
##############################
server {
  listen 80;

  client_max_body_size 4G;
  server_name XN--80AA1ABXAPNQ1A.XN--P1AI;
  keepalive_timeout 5;

  #########################################################
  # This should go to the public folder of your rails app #
  #########################################################
  root /var/www/amily_photo/current/public;

  try_files $uri/index.html $uri.html $uri @app;
  location @amily_photo_server {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;


    #############################################
    # This should be http://upstream; with the  #
    # upstream specified above.                 #
    #############################################
    proxy_pass http://amily_photo_server;
  }
  error_page 500 502 503 504 /500.html;
  location = /500.html {
    #########################################################
    # This should go to the public folder of your rails app #
    #########################################################
    root /var/www/amily_photo/current/public;
  }
}

These posts did not helped:

I have no idea, what to do…

Please, help.

score 0 · Answer 1 · answered Jun 23 '23 at 11:58

To check that the case is in SELinux, you can disable it

sudo setenforce 0

but it's not safe to turn it off, and the problem will return when you reboot

Good detailed article https://nts.strzibny.name/allowing-nginx-to-use-a-pumaunicorn-unix-socket-with-selinux/

In short, you need to execute the command and save the output to the nginx.te file

sudo grep nginx /var/log/audit/audit.log | audit2allow -m nginx
module nginx 1.0;
require {

        type httpd_t;

        type initrc_t;

        class unix_stream_socket connectto;

}
#============= httpd_t ==============

allow httpd_t initrc_t:unix_stream_socket connectto;

and then check, compile and subtract

sudo checkmodule -M -m -o nginx.mod nginx.te
sudo semodule_package -o nginx.pp -m nginx.mod
sudo semodule -i nginx.pp

SELinux is preventing nginx from write access on the Unicorn socket

1 Answers1