CentOS - Apr 2020 - systemctl restart changes permission.

Hi,

I am running CentOS Linux release 7.8.2003 (Core)
with php72u-fpm-7.2.30-1.el7.ius.x86_64 version. I am facing the below
permission denied issue. I also did the below steps
#cd /run
#chown -Rc nginx.nginx php-fpm
changed ownership of ?php-fpm/php-fpm.pid? from root:root to nginx:nginx
changed ownership of ?php-fpm? from root:root to nginx:nginx
#systemctl restart php-fpm again changes it from nginx.nginx to root.root
user.


nginx error logs
> 2020/04/30 03:09:28 [crit] 17175#0: *154570 connect() to
> unix:/run/php-fpm/www.sock failed (13: *Permission denied*) while
> connecting to upstream, client: 49.207.54.161, server: _, request:
"GET /
> HTTP/1.1", upstream:
"fastcgi://unix:/run/php-fpm/www.sock:", host:
> "35.128.212.112"
> 2020/04/30 03:09:28 [error] 17175#0: *154570 open()
> "/var/www/drupal/web/50x.html" failed (2: No such file or
directory),
> client: 49.207.54.161, server: _, request: "GET / HTTP/1.1",
upstream:
> "fastcgi://unix:/run/php-fpm/www.sock", host:
"35.128.212.112"
> 2020/04/30 03:09:35 [crit] 17176#0: *154573 connect() to
> unix:/run/php-fpm/www.sock failed (13: Permission denied) while connecting
> to upstream, client: 49.207.54.161, server: _, request: "GET /
HTTP/1.1",
> upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host:
"35.128.212.112"
> 2020/04/30 03:09:35 [error] 17176#0: *154573 open()
> "/var/www/drupal/web/50x.html" failed (2: No such file or
directory),
> client: 49.207.54.161, server: _, request: "GET / HTTP/1.1",
upstream:
> "fastcgi://unix:/run/php-fpm/www.sock", host:
"35.128.212.112"
> 2020/04/30 03:09:49 [crit] 17175#0: *154575 connect() to
> unix:/run/php-fpm/www.sock failed (13: Permission denied) while connecting
> to upstream, client: 14.98.153.6, server: _, request: "GET /
HTTP/1.1",
> upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host:
"35.128.212.112"
> 2020/04/30 03:09:49 [error] 17175#0: *154575 open()
> "/var/www/drupal/web/50x.html" failed (2: No such file or
directory),
> client: 14.98.153.6, server: _, request: "GET / HTTP/1.1",
upstream:
> "fastcgi://unix:/run/php-fpm/www.sock", host:
"35.128.212.112"
> 2020/04/30 03:09:50 [crit] 17175#0: *154575 connect() to
> unix:/run/php-fpm/www.sock failed (13: Permission denied) while connecting
> to upstream, client: 14.98.153.6, server: _, request: "GET /
HTTP/1.1",
> upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host:
"35.128.212.112"
> 2020/04/30 03:09:50 [error] 17175#0: *154575 open()
> "/var/www/drupal/web/50x.html" failed (2: No such file or
directory),
> client: 14.98.153.6, server: _, request: "GET / HTTP/1.1",
upstream:
> "fastcgi://unix:/run/php-fpm/www.sock", host:
"35.128.212.112"
> 2020/04/30 03:10:46 [crit] 17176#0: *154578 connect() to
> unix:/run/php-fpm/www.sock failed (13: Permission denied) while connecting
> to upstream, client: 184.22.107.148, server: _, request: "GET /
HTTP/1.1",
> upstream: "fastcgi://unix:/run/php-fpm/www.sock:", host:
"35.128.212.112"
> 2020/04/30 03:10:46 [error] 17176#0: *154578 open()
> "/var/www/drupal/web/50x.html" failed (2: No such file or
directory),
> client: 184.22.107.148, server: _, request: "GET / HTTP/1.1",
upstream:
> "fastcgi://unix:/run/php-fpm/www.sock", host:
"35.128.212.112"

Please let me know if you need any additional information. Thanks in
Advance.

Best Regards,

Kaushal

On 4/29/2020 9:06 PM, Kaushal Shriyan wrote:
> I am running CentOS Linux release 7.8.2003 (Core)
> with php72u-fpm-7.2.30-1.el7.ius.x86_64 version. I am facing the below
> permission denied issue. I also did the below steps
> #cd /run
> #chown -Rc nginx.nginx php-fpm
> changed ownership of ?php-fpm/php-fpm.pid? from root:root to nginx:nginx
> changed ownership of ?php-fpm? from root:root to nginx:nginx
> #systemctl restart php-fpm again changes it from nginx.nginx to root.root
> user.
/run is a tmpfs that gets recreated on every boot. Your permission 
changes won't persist a reboot. See here:

https://lwn.net/Articles/436012/

You could instead drop a systemd unit file customization file into 
/etc/systemd that changes the user that php-fpm runs as.

https://www.certdepot.net/rhel-7-systemd-unit-file-customization/

On Thu, Apr 30, 2020 at 10:31 AM Kenneth Porter <shiva at sewingwitch.com>
wrote:
> On 4/29/2020 9:06 PM, Kaushal Shriyan wrote:
> > I am running CentOS Linux release 7.8.2003 (Core)
> > with php72u-fpm-7.2.30-1.el7.ius.x86_64 version. I am facing the below
> > permission denied issue. I also did the below steps
> > #cd /run
> > #chown -Rc nginx.nginx php-fpm
> > changed ownership of ?php-fpm/php-fpm.pid? from root:root to
nginx:nginx
> > changed ownership of ?php-fpm? from root:root to nginx:nginx
> > #systemctl restart php-fpm again changes it from nginx.nginx to
root.root
> > user.
>
> /run is a tmpfs that gets recreated on every boot. Your permission
> changes won't persist a reboot. See here:
>
> https://lwn.net/Articles/436012/
>
> You could instead drop a systemd unit file customization file into
> /etc/systemd that changes the user that php-fpm runs as.
>
> https://www.certdepot.net/rhel-7-systemd-unit-file-customization/
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> https://lists.centos.org/mailman/listinfo/centos

Hi Kenneth,

Thanks for your explanation and for pointing me to the
https://www.certdepot.net/rhel-7-systemd-unit-file-customization/ link.  I
did the following steps to fix the permission issue.

#vim /etc/systemd/system/php-fpm.service
> .include /usr/lib/systemd/system/php-fpm.service
> [Service]
> User=nginx
> Group=nginx
> #systemctl daemon-reload
> #systemctl restart php-fpm.service
> #tree -pug php-fpm
> php-fpm
> ??? [-rw-r--r-- nginx    nginx   ]  php-fpm.pid
> ??? [srw-rw---- nginx    nginx   ]  www.sock

It worked like a charm. Much appreciated for your help.

Best Regards,

Kaushal