proxy_pass isn't working when SELinux is enabled, why?

nginx reverse-proxy selinux
Vijay Shankar Kalyanaraman picture Vijay Shankar Kalyanaraman · Dec 12, 2014 · Viewed 25k times · Source

I'm having an application listening on port 8081 and Nginx running on port 8080. The proxy pass statement looks like:

$ cat /var/etc/opt/lj/output/services/abc.servicemanager.conf

location /api/abc.servicemanager/1.0 { proxy_pass     http://localhost:8081;}

In nginx.conf, I include this file as:

include /etc/nginx/conf.d/services/*.conf;

The /etc/nginx/conf.d/service is a symlink: 

# ll /etc/nginx/conf.d/

lrwxrwxrwx. 1 root root   39 Dec 10 00:19 services -> ../../../var/etc/opt/lj/output/services

This is a CentOS 7.0 SELinux Enabled system. If I setenforce 0, and make it Permissive, I don't see any issues. So the file is in right place and no issues with paths. If SELinux is enforcing, I see the following in audit log:

type=AVC msg=audit(1418348761.372:100930): avc:  denied  { getattr } for  pid=3936 comm="nginx" path="/var/etc/opt/lj/output/services/abc.servicemanager.conf" dev="xvda1" ino=11063393 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file

I want to know how to enable Nginx to find the conf file without having to disable SELinux.

Answer

Cristian Romanescu picture Cristian Romanescu · Mar 3, 2015

Worth noting for beginners in SELinux that if your proxied service is running on 8080, you can use the command below without compiling a policy.

$ sudo setsebool httpd_can_network_connect 1 -P

Related questions

From inside of a Docker container, how do I connect to the localhost of the machine?

So I have a Nginx running inside a docker container, I have a mysql running on localhost, I want to connect to the MySql from within my Nginx. The MySql is running on localhost and not exposing a port to …

Read More
Nginx reverse proxy causing 504 Gateway Timeout

I am using Nginx as a reverse proxy that takes requests then does a proxy_pass to get the actual web application from the upstream server running on port 8001. If I go to mywebsite.com or do a wget, I …

Read More
How to serve all existing static files directly with NGINX, but proxy the rest to a backend server.

location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; if (-f $request_filename) { access_log off; expires 30d; break; } if (!-f $request_filename) { proxy_pass http://127.0.0.1:8080; # backend server …

Read More