Wordpress overloads LEMP

Question

My current configuration:

GCE f1-micro (1 vCPU, 0.6GB) Haswell, CentOS 7.2, NGINX 1.10.2, PHP 7.0.12

Static pages serve without issue.
phpinfo() page servers without issue.
WordPress setup page overloads CPU causing me to reset the server.

[error] 29111#0: *43 FastCGI sent in stderr: "PHP message: PHP Warning: Unknown: failed to open stream: Permission denied in Unknown on line 0

Unable to open primary script: /var/www/mysite.com/public/index.php (Permission denied)" while reading response header from upstream, client: XX.XXX.XXX.XXX, server: _, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock:", host: "XXX.XXX.XXX.XXX"

NGINX *.conf file location directives

location / {
    try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
    try_files                  $uri =404;
    fastcgi_split_path_info    ^(.+\.php)(/.+)$;
    fastcgi_pass               unix:/var/run/php-fpm/php-fpm.sock;
    fastcgi_index              index.php;
    include                    /etc/nginx/fastcgi.conf;
}
location ~ ^/(status|ping)$ {
    access_log off;
    include                    /etc/nginx/fastcgi.conf;
    fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
}

NGINX

user = rocky

PHP-FPM

user = rocky

group = rocky

listen.owner = rocky

listen.group = rocky

listen.mode = 0660

Public permissions

/var/

drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 www

/var/www/

drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 mydomain

/var/www/mydomain/

drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 public

/var/www/mydomain/public

-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 index.html
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 index.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 info.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 license.txt
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 readme.html
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-activate.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-admin
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-blog-header.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-comments-post.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-config-sample.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-content
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-cron.php
drwxr-xr-x. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-includes
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-links-opml.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-load.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-login.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-mail.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-settings.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-signup.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-trackback.php
-rw-r--r--. rocky rocky unconfined_u:object_r:httpd_sys_rw_content_t:s0 xmlrpc.php

Audit Log

type=SYSCALL msg=audit(1480104445.879:461): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=10000 a2=7 a3=22 items=0 ppid=1270 pid=1275 auid=4294967295 uid=1000 gid=1001 euid=1000 suid=1000 fsuid=1000 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)

type=AVC msg=audit(1480104445.879:461): avc: denied { execmem } for pid=1275 comm="php-fpm" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=process

You haven't really described your problem well. "setup page overloads CPU causing me to reset the server" is quite ambiguous. You need to reboot the server? You need to restart the PHP process? What process takes CPU? What does the PHP and Wordpress error log say? You may have to enable Wordpress debugging and debug log file (they're separate config file entries). This sounds quite easily solvable once all information is known. Could be permissions as suggested above. — Tim, Nov 25 '16 at 18:35
Hm, the permissions you've posted look OK. Check the audit log to see if any AVC denials are logged. — Michael Hampton, Nov 25 '16 at 18:45
@MichaelHampton Audit log appended. Also, nowhere in my LEMP setup do I address anon_hugepage. — Ryan Prentiss, Nov 25 '16 at 19:00
That's not the audit log, it's a summary. You need to look at the specific log entries. — Michael Hampton, Nov 25 '16 at 19:05
@MichaelHampton I've appended the recent Audit Log output via pastebin link. — Ryan Prentiss, Nov 25 '16 at 20:16
@Tim setroubleshootd is causing the system to crawl. SELinux is throwing errors I'm not capable of resolving. — Ryan Prentiss, Nov 25 '16 at 20:50
I'd just build a new server, or ideally in AWS I'd have a template and it would build itself. — Tim, Nov 26 '16 at 00:34

score 0 · Answer 1 · answered Nov 26 '16 at 09:58

0

The issue was SELinux. I resolved the issue by allowing httpd access to execmem.

setsebool -P httpd_execmem 1

answered Nov 26 '16 at 09:58

Ryan Prentiss

291
5
11

Wordpress overloads LEMP

1 Answers1