Fixing nginx “13: Permission Denied” Error on RHEL8 with SELinux

Fix nginx Permission denied when proxying to a non-standard port by adjusting SELinux settings.

Takahiro Iwasa

2021-08-28

2 min read

When configuring nginx to route traffic to a non-standard port such as 1080 on an instance, you may encounter the error 13: Permission denied. This issue often arises due to SELinux restrictions.

1
systemd[1]: Starting The nginx HTTP and reverse proxy server...
2
nginx[1626]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
3
nginx[1626]: nginx: [emerg] bind() to 0.0.0.0:1080 failed (13: Permission denied)
4
nginx[1626]: nginx: configuration file /etc/nginx/nginx.conf test failed
5
systemd[1]: nginx.service: Control process exited, code=exited status=1
6
systemd[1]: nginx.service: Failed with result 'exit-code'.
7
systemd[1]: Failed to start The nginx HTTP and reverse proxy server.

Solution

The fix is to allow nginx to use the custom port 1080 by updating SELinux policies:

sudo semanage port -a -t http_port_t -p tcp 1080

If you encounter the error sudo: semanage: command not found, install the required package with these commands:

sudo dnf provides /usr/sbin/semanage
sudo dnf install policycoreutils-python-utils

Conclusion

Labeling port 1080 as http_port_t with semanage port resolved nginx’s 13: Permission denied error when binding to that non-standard port on RHEL8. The error message looks identical to a firewall or file-permissions problem, but on RHEL8 with SELinux enforcing, it usually just means the port hasn’t been labeled as a type nginx is allowed to bind to. semanage port -a -t http_port_t -p tcp 1080 fixes it in one line once that’s understood, and the same command is worth reaching for immediately any time a new non-standard port gets added to an nginx config on an SELinux-enforced host, rather than re-diagnosing the same error from scratch.

Back to posts