CentOS7 nginx permission denied for media and static

Question

Hello

I have tried to deploy django web server for a week and finally I did it, but now I have a permission denied problem with nginx

/var/log/nginx/errors.log

/2016-07-12_1.png HTTP/1.0", host: "ip"      2017/08/28 08:22:38 [error] 873#0: *122 open() "/srv/www/Best/media/Profile Pictures/1/2016-07-12_1.png" failed (13: Permission denied), client: 94.183.22.168, server: ip, request: "GET /media/Profile%20Pictures/1/2016-07-12_1.png HTTP/1.0", host: "ip"

www folder permission

drwxr-xr-x 4 root nginx 4096 Aug 27 15:05 www

Best (project folder) permission

drwxrw-r-- 9 uwsgi nginx 4096 Aug 27 21:27 Best

media folder permission

drw-rw-r-- 3 uwsgi nginx   4096 Aug 26 12:32 media

static folder permission

drwxrwxr-x 3 uwsgi nginx   4096 Aug 27 21:22 static

Solution

You have set drwxrw-r-- for directories. It should be at least one of the following:

• drwxrwxr-x - Read, write and execute by the group, all can see contents too. Not recommended unless you really need write access by the group.
• drwxr-xr-x - Read and execute by the group, all can see contents too.
• drwxr-x--- - Read and execute by the group.

You have not shown the permissions for the files either. This could also be an issue.

I have two options for you. Fix each folder and file individually or fix the lot in one go. Fixing the lot in one go may remove any special permissions (like write access) but that can be fixed later too if you know what you are doing.

Option 1, set per directory and file:

sudo chmod 750 /path/to/each/directory
sudo chmod 640 /path/to/each/file

Option 2, set for all:

sudo find /path/to/www/root -type d -print0 | xargs -0 chmod 750
sudo find /path/to/www/root -type f -print0 | xargs -0 chmod 640

Personally, I would use 750 (drwxr-x---) for directories and 640 (-rw-r----) for files on a website but you may want to use 755 (drwxr-xr-x) and 644 (-rw-r--r--).

Comments

[lese]

what about permissions of specific file /srv/www/Best/media/Profile Pictures/1/2016-07-12_1.png? Just to know, is SElinux enabled and enforced?