nginx 403 根用户的禁止错误答案

【问题标题】：nginx 403 Forbidden error with root usernginx 403 根用户的禁止错误
【发布时间】：2016-08-16 22:53:38
【问题描述】：

Nginx 403 错误，我该如何解决这个问题？当我从 chrome 浏览器访问 main.css 时，它响应我 403 错误。

➜  ~ tail -fn4 /var/log/nginx/error.log
2016/04/23 08:16:51 [error] 10488#0: *1 open() "/data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css" failed (13: Permission denied), client: x.x.x.x, server: www.xx.com, request: "GET /static/css/main.css HTTP/1.1", host: "xx.com"
2016/04/23 08:16:53 [error] 10488#0: *1 open() "/data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css" failed (13: Permission denied), client: x.x.x.x, server: www.xx.com, request: "GET /static/css/main.css HTTP/1.1", host: "xx.com"
2016/04/23 08:21:48 [error] 10488#0: *4 open() "/data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css" failed (13: Permission denied), client: x.x.x.x, server: www.xx.com, request: "GET /static/css/main.css HTTP/1.1", host: "xx.com"
2016/04/23 08:24:49 [error] 10488#0: *5 open() "/data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css" failed (13: Permission denied), client: x.x.x.x, server: www.xx.com, request: "GET /static/css/main.css HTTP/1.1", host: "xx.com"

namei工具，所有父目录有755，main.css有644。

➜  ~ namei -l /data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css
f: /data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css
drwxr-xr-x root root /
drwxr-xr-x root root data
drwxr-xr-x root root apache-tomcat-8.0.33
drwxr-xr-x root root webapps
drwxr-xr-x root root ROOT
drwxr-xr-x root root static
drwxr-xr-x root root css
-rw-r--r-- root root main.css

启动nginx的用户是root：

➜  ~ ps aux | grep "nginx: worker process" | awk '{print $1}'
root

nginx 配置：

   upstream tomcat {
       server 127.0.0.1:8887;
   }


 server {
    listen       80;
    server_name  www.xx.com xx.com;


    charset utf-8;
    access_log  /var/log/nginx/tomcat.access.log  main;

    location / {

        proxy_pass        http://tomcat;
        proxy_redirect off;
        client_max_body_size 500M;

        proxy_set_header  Host  $host;
        proxy_set_header  X-Real-IP  $remote_addr;
        proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

    }

    location ~ .*\.(gif|jpg|jpeg|bmp|png|ico|txt|js|css)$
    {
        root /data/apache-tomcat-8.0.33/webapps/ROOT;
        expires      7d;
    }

    location ~ ^/(WEB-INF)/ {
        deny all;
    }

}

【问题讨论】：

您好，先生！你是怎么解决的，我也有同样的问题，即使有权限。

标签： nginx

【解决方案1】：

很有可能您托管在一台强制执行 selinux 的机器上。

sestatus 给你什么？

【讨论】：