Fixing nginx “13: Permission Denied” on RHEL 8 with SELinux

Allow nginx to bind to a non-standard port on RHEL 8 by adding the appropriate SELinux port label.

Takahiro Iwasa

2021-08-28

2 min read

When nginx is configured to listen on a non-standard port such as 1080 on RHEL 8, it may fail with 13: Permission denied. SELinux port labeling is a common cause.

1
systemd[1]: Starting The nginx HTTP and reverse proxy server...
2
nginx[1626]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
3
nginx[1626]: nginx: [emerg] bind() to 0.0.0.0:1080 failed (13: Permission denied)
4
nginx[1626]: nginx: configuration file /etc/nginx/nginx.conf test failed
5
systemd[1]: nginx.service: Control process exited, code=exited status=1
6
systemd[1]: nginx.service: Failed with result 'exit-code'.
7
systemd[1]: Failed to start The nginx HTTP and reverse proxy server.

Solution

The fix is to allow nginx to use the custom port 1080 by updating SELinux policies:

sudo semanage port -a -t http_port_t -p tcp 1080

If you encounter the error sudo: semanage: command not found, install the required package with these commands:

sudo dnf provides /usr/sbin/semanage
sudo dnf install policycoreutils-python-utils

Conclusion

Labeling port 1080 as http_port_t with semanage port allows nginx to bind to the non-standard port on RHEL 8.

Although the message resembles a file-permission error, SELinux denies the bind operation when the port is not labeled with a type that nginx may use.

When adding another non-standard listening port on an SELinux-enforcing host, check its SELinux port label before changing file permissions or firewall settings.

Back to posts