1

I have an issue with php-fpm. It is actually the php7 version. I have drupal and it will complain that some directory is not writtable. Only if I start php-fpm as a service like that:

#service php-fpm start

I am using nginx as web server and php-fpm, in port 127.0.0.1:9000. This is my conf in /etc/php-fpm.d/www.conf:

; Start a new pool named 'www'.
[www]
user = nginx
group = nginx
listen = 127.0.0.1:9000

All the documents for web - drupal - belong to nginx:nginx. If I start the service, either

#service php-fpm start

or

#systemctl start php-fpm

It will complain about permissions, even though that ps shows this (ps aux | grep php-fpm):

root      1591  0.0  0.8 528916 31260 ?        Ss   07:49   0:00 php-fpm: master process (/etc/php-fpm.conf)
nginx     1593  0.0  2.2 567252 79768 ?        S    07:49   0:03 php-fpm: pool www
nginx     1594  0.0  1.9 565248 72004 ?        S    07:49   0:01 php-fpm: pool www
nginx     1595  0.0  2.0 567268 73040 ?        S    07:49   0:02 php-fpm: pool www
nginx     1596  0.0  2.0 573440 75320 ?        S    07:49   0:01 php-fpm: pool www
nginx     1597  0.0  1.9 568704 71812 ?        S    07:49   0:02 php-fpm: pool www
nginx     1600  0.0  2.0 572360 74632 ?        S    07:50   0:01 php-fpm: pool www
nginx     1604  0.0  1.8 565264 68584 ?        S    07:53   0:01 php-fpm: pool www

So it looks like the user was properly set. But it's not working.

Now what I really don't understand is that if I execute this:

#/usr/sbin/php-fpm --nodaemonize --fpm-config /etc/php-fpm.conf

Which is the command described in the service (/usr/lib/systemd/system/php-fpm.service) - Then I have no permission issues.

The output of ps aux | grep php-fpm is the same, with nginx being the user.

I am executing everything as root.

How is this possible?

Edit

This has become a SElinux question. I have this in the audit logs:

denied  { write } for  pid=2755 comm="php-fpm" name="files" dev="xvda1" ino=9167949 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir

The directory I want php-fpm to write is the one called vanilladrupal

# ls -Z .
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 html
drwxr-xr-x. nginx  nginx  unconfined_u:object_r:httpd_sys_content_t:s0 vanilladrupal

The process php-fpm has this context:

 ps Zaux | grep php-fpm
system_u:system_r:httpd_t:s0    root      2749  0.0  0.8 528916 31212 ?        Ss   03:03   0:00 php-fpm: master process (/etc/php-fpm.conf)
system_u:system_r:httpd_t:s0    nginx     2751  0.0  0.5 529548 19456 ?        S    03:03   0:00 php-fpm: pool www
and the other pool wwww look the same

The selinux config is this:

SELINUX=enforcing
SELINUXTYPE=targeted

What change should I do?

(here, kind of argues that the way it is set, should have no permission issues)

(I tried to change the context for the directory "vanilla drupal" to look the same as html (I assum that if I had put the dir inside html I wouldn't have any problem), by changing the user. But I just got even more errors (forbidden {execmem}).

Community
  • 1
Cesc
  • 191
  • 9
  • 1
    Have you checked audit logs? – Florin Asăvoaie Dec 07 '15 at 09:09
  • @FlorinAsăvoaie Oh I had no idea about that. It says `denied { write } for pid=1594 comm="php-fpm" name="files" dev="xvda1" ino=9167949 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir` so it's definitely that. I'll research about that (do you know any online tutorial about that?) – Cesc Dec 08 '15 at 02:20

1 Answers1

2

You will need to change the SELinux context for all files where Drupal needs to write to httpd_sys_rw_content_t, something like this:

semanage fcontext -a -t httpd_sys_rw_content_t '/usr/share/nginx/html/drupal/admin/config/media/file-system(/.*)?'

I don't know what are your paths and you need to check in Drupal interface in Configuration -> Media -> Filesystem for more information.

Florin Asăvoaie
  • 6,932
  • 22
  • 35
  • Exactly this. It looks the semanage takes into account the current directory from where you are executing the command `semanage fcontext --add --type httpd_sys_rw_content_t "/www(/.*)?"` .Oh I ws in the same www dir. I'm not sure, but it complains when I tried `"/var/www(/.*)?"`. I have checked the differences between permissions from httpd_t to httpd_ss_content_t : dir and the one with rw in it : dir , using sesearch command, and there repeated entries with different {privileges}, I am quite confused, but I might ask a different question. Thanks for this one – Cesc Dec 08 '15 at 05:46