'sudo nginx' vs 'sudo service nginx start'答案

【问题标题】：'sudo nginx' vs 'sudo service nginx start''sudo nginx' vs 'sudo service nginx start'
【发布时间】：2015-03-01 20:40:48
【问题描述】：

我有以下设置：

NGINX 1.6.2, Rails 4, Unicorn, Capistrano 3.1

我在/var/log/nginx/error.log 中收到以下错误

2015/01/03 22:27:13 [crit] 49826#0: *77 stat() "/home/mjp/apps/mjp-portal_staging/current/public//index.html" failed (13: Permission denied), client: 182.178.190.121, server: 185.48.117.98, request: "GET / HTTP/1.1", host: "185.48.117.98"
2015/01/03 22:27:13 [crit] 49826#0: *77 stat() "/home/mjp/apps/mjp-portal_staging/current/public/" failed (13: Permission denied), client: 182.178.190.121, server: 185.48.117.98, request: "GET / HTTP/1.1", host: "185.48.117.98"
2015/01/03 22:27:13 [crit] 49826#0: *77 connect() to unix:/tmp/unicorn.mjp-portal_staging.sock failed (13: Permission denied) while connecting to upstream, client: 182.178.190.121, server: 185.48.117.98, request: "GET / HTTP/1.1", upstream: "http://unix:/tmp/unicorn.mjp-portal_staging.sock:/", host: "185.48.117.98"
2015/01/03 22:27:13 [crit] 49826#0: *77 stat() "/home/mjp/apps/mjp-portal_staging/current/public/500.html/index.html" failed (13: Permission denied), client: 182.178.190.121, server: 185.48.117.98, request: "GET / HTTP/1.1", upstream: "http://unix:/tmp/unicorn.mjp-portal_staging.sock/", host: "185.48.117.98"
2015/01/03 22:27:13 [crit] 49826#0: *77 stat() "/home/mjp/apps/mjp-portal_staging/current/public/500.html" failed (13: Permission denied), client: 182.178.190.121, server: 185.48.117.98, request: "GET / HTTP/1.1", upstream: "http://unix:/tmp/unicorn.mjp-portal_staging.sock/", host: "185.48.117.98"
2015/01/03 22:27:13 [crit] 49826#0: *77 connect() to unix:/tmp/unicorn.mjp-portal_staging.sock failed (13: Permission denied) while connecting to upstream, client: 182.178.190.121, server: 185.48.117.98, request: "GET / HTTP/1.1", upstream: "http://unix:/tmp/unicorn.mjp-portal_staging.sock:/500.html", host: "185.48.117.98"
2015/01/03 22:27:14 [crit] 49826#0: *77 stat() "/home/mjp/apps/mjp-portal_staging/current/public/favicon.ico/index.html" failed (13: Permission denied), client: 182.178.190.121, server: 185.48.117.98, request: "GET /favicon.ico HTTP/1.1", host: "185.48.117.98"
2015/01/03 22:27:14 [crit] 49826#0: *77 stat() "/home/mjp/apps/mjp-portal_staging/current/public/favicon.ico" failed (13: Permission denied), client: 182.178.190.121, server: 185.48.117.98, request: "GET /favicon.ico HTTP/1.1", host: "185.48.117.98"
2015/01/03 22:27:14 [crit] 49826#0: *77 connect() to unix:/tmp/unicorn.mjp-portal_staging.sock failed (13: Permission denied) while connecting to upstream, client: 182.178.190.121, server: 185.48.117.98, request: "GET /favicon.ico HTTP/1.1", upstream: "http://unix:/tmp/unicorn.mjp-portal_staging.sock:/favicon.ico", host: "185.48.117.98"
2015/01/03 22:27:14 [crit] 49826#0: *77 stat() "/home/mjp/apps/mjp-portal_staging/current/public/500.html/index.html" failed (13: Permission denied), client: 182.178.190.121, server: 185.48.117.98, request: "GET /favicon.ico HTTP/1.1", upstream: "http://unix:/tmp/unicorn.mjp-portal_staging.sock/favicon.ico", host: "185.48.117.98"
2015/01/03 22:27:14 [crit] 49826#0: *77 stat() "/home/mjp/apps/mjp-portal_staging/current/public/500.html" failed (13: Permission denied), client: 182.178.190.121, server: 185.48.117.98, request: "GET /favicon.ico HTTP/1.1", upstream: "http://unix:/tmp/unicorn.mjp-portal_staging.sock/favicon.ico", host: "185.48.117.98"
2015/01/03 22:27:14 [crit] 49826#0: *77 connect() to unix:/tmp/unicorn.mjp-portal_staging.sock failed (13: Permission denied) while connecting to upstream, client: 182.178.190.121, server: 185.48.117.98, request: "GET /favicon.ico HTTP/1.1", upstream: "http://unix:/tmp/unicorn.mjp-portal_staging.sock:/500.html", host: "185.48.117.98"

我尝试将nginx 以root、mjp 和nginx 作为用户运行，但我得到了同样的错误。

即使 nginx 也不会从 sites-enabled/symlink-to-deploy-root-shared-config-nginx.conf 创建服务器，尽管它确实包含在 nginx -t 测试中。

我做错了什么？

【问题讨论】：

标签： ruby-on-rails nginx capistrano unicorn rbenv

【解决方案1】：

我让它工作了。实际上这不是目录的权限错误。

我停止了 nginx 服务，然后以sudo nginx 的身份启动它，通过它我能够在一切正常的情况下运行应用程序。但是当我尝试通过sudo service nginx start 将它作为服务运行时，它给出了上述错误，因为根目录和套接字的权限被拒绝。

我在服务器故障上发布了同样的问题，很幸运得到了答案。

这里是answer：

这是一个 selinux 问题。

当你运行 sudo nginx 时，它会以 unconfined_t 启动 nginx，当你运行时 sudo service nginx start 它以 nginx 开头，httpd_t。

最初从 sudo 开始，它会创建一堆文件和将其状态初始化为 unconfined_t。例如 pid 文件将是错误的上下文。因此当使用 service nginx stop 终止时 httpd_t 没有足够的权限读取写入的文件通过unconfined_t。

你真的应该总是开始使用服务，这将避免这种情况问题。要更正它，您需要重新标记有状态的文件存在于文件系统中，例如运行 restorecon /var/run/nginx.pid 将更正该 pid 上设置的错误标签文件。

我不确定是否还有更多文件被写出创建的服务也需要更正。你可以得到一个这些可能正在执行的文件列表ausearch -ts recent -m avc。

【讨论】：