SELinux prevents Nginx from reading file [duplicate]

I have nginx running on my CentOS 7 machine. Every day I run a cron job that generates new Diffie-Hellman parameters. They are saved in /etc/ssl/dh/dhparam.pem. But SELinux is preventing nginx from reading this file.

This is the line in the nginx error log:

nginx[3189]: nginx: [emerg] BIO_new_file("/etc/ssl/dh/dhparam.pem") failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/ssl/dh/dhparam.pem','r') error:2006D002:BIO routines:BIO_new_file:system lib)

This is the audit log:

type=AVC msg=audit(1473285202.181:334): avc:  denied  { open } for  pid=1393 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473285832.647:743): avc:  denied  { open } for  pid=2958 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287010.821:803): avc:  denied  { open } for  pid=3083 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646316 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287142.871:826): avc:  denied  { open } for  pid=3118 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287172.480:843): avc:  denied  { open } for  pid=3134 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
type=AVC msg=audit(1473287681.994:866): avc:  denied  { open } for  pid=3189 comm="nginx" path="/etc/ssl/dh/dhparam.pem" dev="dm-1" ino=101646309 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file

I'm not very familiar with SELinux (I know I should learn that): How can I grant nginx access without disabeling SELinux (or setting it to permissive)?

Solution 1:

SELinux is denying you access to the file, since you moved instead of copied it from somewhere else on the filesystem into its final location. Thus it kept its original security context, which didn't allow Apache to access it.

To resolve the issue, relabel the file with restorecon.

To avoid the problem in future, copy files (and delete the original if necessary), or use mv -Z.