SELinux权限案例
系统更新后Nginx启动失败
journalctl -u nginx.service
中的日志为:
Starting The nginx HTTP and reverse proxy server...
nginx[2505]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx[2505]: nginx: [emerg] open() "/var/log/onlyoffice/documentserver/nginx.error.log" failed (13: Permission denied)
nginx[2505]: nginx: configuration file /etc/nginx/nginx.conf test failed
systemd[1]: nginx.service: Control process exited, code=exited status=1
systemd[1]: nginx.service: Failed with result 'exit-code'.
systemd[1]: Failed to start The nginx HTTP and reverse proxy server.
是由于 Nginx 没有足够的权限来访问日志文件 /var/log/onlyoffice/documentserver/nginx.error.log
导致的。
检查日志文件权限:ls -l /var/log/onlyoffice/documentserver/nginx.error.log
正常
检查SELinux 上下文:ls -Z /var/log/onlyoffice/documentserver/nginx.error.log
发现没有 httpd_log_t
类型标记
使用命令更正为正确的上下文:sudo restorecon -v /var/log/onlyoffice/documentserver/nginx.error.log
为能修正,尝试添加一个自定义的 SELinux 策略来允许 Nginx 访问日志文件
sudo semanage fcontext -a -t httpd_log_t "/var/log/onlyoffice(/.*)?"
sudo restorecon -R -v /var/log/onlyoffice
再次检查SELinux 上下文:ls -Z /var/log/onlyoffice/documentserver/nginx.error.log
已设置 httpd_log_t
类型标记
sudo systemctl restart nginx
成功重启Nginx服务