Nginx error: (13: Permission denied) while connecting to upstream

Question

I am getting this error in my nginx-error.log file:

2014/02/17 03:42:20 [crit] 5455#0: *1 connect() to unix:/tmp/uwsgi.sock failed (13: Permissi         


        

Answer 1

While the accepted solution is true there might also SELinux be blocking the access. If you did set the permissions correctly and still get permission denied messages try:

sudo setenforce Permissive

If it works then SELinux was at fault - or rather was working as expected! To add the permissions needed to nginx do:

  # to see what permissions are needed.
sudo grep nginx /var/log/audit/audit.log | audit2allow
  # to create a nginx.pp policy file
sudo grep nginx /var/log/audit/audit.log | audit2allow -M nginx
  # to apply the new policy
sudo semodule -i nginx.pp

After that reset the SELinux Policy to Enforcing with:

sudo setenforce Enforcing

Answer 2

The permission issue occurs because uwsgi resets the ownership and permissions of /tmp/uwsgi.sock to 755 and the user running uwsgi every time uwsgi starts.

The correct way to solve the problem is to make uwsgi change the ownership and/or permission of /tmp/uwsgi.sock such that nginx can write to this socket. Therefore, there are three possible solutions.

1. Run uwsgi as the www-data user so that this user owns the socket file created by it.

   uwsgi -s /tmp/uwsgi.sock -w my_app:app --uid www-data --gid www-data
   

2. Change the ownership of the socket file so that www-data owns it.

   uwsgi -s /tmp/uwsgi.sock -w my_app:app --chown-socket=www-data:www-data
   

3. Change the permissions of the socket file, so that www-data can write to it.

   uwsgi -s /tmp/uwsgi.sock -w my_app:app --chmod-socket=666
   

I prefer the first approach because it does not leave uwsgi running as root.

The first two commands need to be run as root user. The third command does not need to be run as root user.

The first command leaves uwsgi running as www-data user. The second and third commands leave uwsgi running as the actual user that ran the command.

The first and second command allow only www-data user to write to the socket. The third command allows any user to write to the socket.

I prefer the first approach because it does not leave uwsgi running as root user and it does not make the socket file world-writeable .

Answer 3

I know it's too late, but it might helps to other. I'll suggest to follow Running flask with virtualenv, uwsgi, and nginx very simple and sweet documentation.

Must activate your environment if you run your project in virtualenv.

here is the yolo.py

from config import application

if __name__ == "__main__":
    application.run(host='127.0.0.1')

And create uwsgi.sock file in /tmp/ directory and leave it blank. As @susanpal answer said "The permission issue occurs because uwsgi resets the ownership and permissions of /tmp/uwsgi.sock to 755 and the user running uwsgi every time uwsgi starts." it is correct.

So you have to give permission to sock file whenever uwsgi starts. so now follow the below command

uwsgi -s /tmp/uwsgi.sock -w yolo:application -H /var/www/yolo/env --chmod-socket=666 

A little different command from @susanpal. And for persist connection, simply add "&" end of command

uwsgi -s /tmp/uwsgi.sock -w yolo:app -H /var/www/yolo/env --chmod-socket=666 &

Answer 4

In my case changing some php permission do the trick

sudo chown user:group -R /run/php

I hope this helps someone.

Answer 5

You have to set these permissions (chmod/chown) in uWSGI configuration.

It is the chmod-socket and the chown-socket.

http://uwsgi-docs.readthedocs.org/en/latest/Options.html#chmod-socket http://uwsgi-docs.readthedocs.org/en/latest/Options.html#chown-socket

Answer 6

You should post both nginx and uwsgi configuration file for your application (the ones in /etc/nginx/sites-enabled/ and /etc/uwsgi/ - or wherever you put them).

Typically check that you have a line similar to the following one in your nginx app configuration:

uwsgi_pass unix:///tmp/uwsgi.sock;

and the same socket name in your uwsgi config file:

socket=/tmp/uwsgi.sock