Permission denied: httpd: could not open error log file /etc/httpd/logs/error_log

user_2515498 0
Viewed 36825

When I want to restart the httpd searvice on centOS 6.7 I have the following error:

/etc/init.d/httpd restart
Stopping httpd:                                            [FAILED]
Starting httpd: (13)Permission denied: httpd: could not open error log file /etc/httpd/logs/error_log.
Unable to open logs
                                                           [FAILED]

This is error_log:

ls -Z /etc/httpd/logs/error_log
-rw-r--r--. root root unconfined_u:object_r:var_t:s0   /etc/httpd/logs/error_log

I disabled selinux also.

What is the problem?

httpd.conf selinux apache php
5 Answers
user_108470120

If you are on RedHat/Fedora/CentOS/RockyLinux then try to execute the following command (14:00 is your time since the error happened):

journalctl -t setroubleshoot --since=14:00

You could see the following errors:

Jun 25 14:21:33 fedora setroubleshoot[1609]: SELinux is preventing httpd from open access on the file /var/log/gitea/error_log. For complete SELinux messages run: sealert -l 5e2bf467-e935-4fa7-a7fd-d0f7f257828e
Jun 25 14:21:33 fedora setroubleshoot[1609]: SELinux is preventing httpd from open access on the file /var/log/gitea/error_log.

                                             *****  Plugin catchall (100. confidence) suggests   **************************

                                             If you believe that httpd should be allowed open access on the error_log file by default.
                                             Then you should report this as a bug.
                                             You can generate a local policy module to allow this access.
                                             Do
                                             allow this access for now by executing:
                                             # ausearch -c 'httpd' --raw | audit2allow -M my-httpd
                                             # semodule -X 300 -i my-httpd.pp

It means the lack of permissions is not related to chmod, but rather to SELinux.

In order to fix the issue you need to execute the following command (please adjust the log directory accordinly):

semanage fcontext -a -t httpd_sys_rw_content_t '/var/log/gitea(/.*)?'
restorecon -Rv '/var/log/gitea/'
systemctl restart httpd

The error should disappear. And please never switch off the SELinux permanently (as someone might suggest) because your server could be compromised.

user_11433490
Related