CentOS上Django项目Gunicorn.service启动持续提示权限拒绝

环境信息 #

• 系统：CentOS Stream 9 (CS9-20230110)
• Python：3.9
• Django：4.0.2
• Nginx：1.22.1
• Gunicorn：21.2.0
• 部署环境：AWS Lightsail实例

问题现象 #

• 手动执行Gunicorn命令（绑定端口8000或Unix Socket）可正常启动服务
• 通过systemd启动gunicorn.service时，持续报错Permission denied，错误码203/EXEC
• 添加EnvironmentFile配置后，同样触发权限拒绝错误

关键排查信息 #

目录结构 #

# /home/ec2-user/Django
Django
├── Django_Project
│   ├── db.sqlite3
│   ├── manage.py
│   ├── mysite
│   │   ├── asgi.py
│   │   ├── db.sqlite3
│   │   ├── __init__.py
│   │   ├── __pycache__
│   │   ├── settings
│   │   │   ├── base.py
│   │   │   ├── local.py
│   │   │   └── prod.py
│   │   ├── urls.py
│   │   └── wsgi.py
│   ├── nohup.out
│   ├── README.md
│   ├── static
│   │   ├── bootstrap.min.css
│   │   ├── bootstrap.min.js
│   │   └── style.css
│   └── templates
│       └── base.html
└── venv
    ├── bin
    │   ├── activate
    │   ├── activate.csh
    │   ├── activate.fish
    │   ├── Activate.ps1
    │   ├── django-admin
    │   ├── gunicorn
    │   ├── markdown_py
    │   ├── pip
    │   ├── pip3
    │   ├── pip3.11
    │   ├── pip3.9
    │   ├── python -> python3
    │   ├── python3 -> /usr/bin/python3
    │   ├── python3.9 -> python3
    │   ├── sqlformat
    │   └── wheel
    ├── gunicorn.sock
    ├── include
    ├── lib
    │   └── python3.9
    ├── lib64 -> lib
    ├── mysite.env
    └── pyvenv.cfg

systemd状态输出 #

[root@ip-172-26-14-187 ec2-user]# systemctl status gunicorn.service
× gunicorn.service - gunicorn daemon
     Loaded: loaded (/etc/systemd/system/gunicorn.service; disabled; preset: disabled)
     Active: failed (Result: exit-code) since Sat 2023-12-09 17:55:51 UTC; 1s ago
   Duration: 6ms
TriggeredBy: ○ gunicorn.socket
    Process: 55311 ExecStart=/home/ec2-user/Django/venv/bin/gunicorn --workers 2 --bind unix:/home/ec2-user/Django/venv/gunicorn.sock mysite.wsgi:application (code=exited>
   Main PID: 55311 (code=exited, status=203/EXEC)
        CPU: 3ms

Dec 09 17:55:51 ip-172-26-14-187.ap-northeast-2.compute.internal systemd[1]: Started gunicorn daemon.
Dec 09 17:55:51 ip-172-26-14-187.ap-northeast-2.compute.internal systemd[55311]: gunicorn.service: Failed to locate executable /home/ec2-user/Django/venv/bin/gunicorn: Permission denied
Dec 09 17:55:51 ip-172-26-14-187.ap-northeast-2.compute.internal systemd[55311]: gunicorn.service: Failed at step EXEC spawning /home/ec2-user/Django/venv/bin/gunicorn: Permission denied
Dec 09 17:55:51 ip-172-26-14-187.ap-northeast-2.compute.internal systemd[1]: gunicorn.service: Main process exited, code=exited, status=203/EXEC
Dec 09 17:55:51 ip-172-26-14-187.ap-northeast-2.compute.internal systemd[1]: gunicorn.service: Failed with result 'exit-code'.

添加EnvironmentFile=/home/ec2-user/Django/venv/mysite.env后报错：

gunicorn.service: Failed to load environment files: Permission denied
gunicorn.service: Failed to run 'start' task: Permission denied
gunicorn.service: Failed with result 'resources'.

权限信息 #

项目及venv目录：

drwxrwxr-x. 8 ec2-user ec2-user 176 Dec  9 11:07 Django_Project
drwxr-xr-x. 8 ec2-user ec2-user 176 Dec  7 17:43 Django_Project_Backup
drwxrwxr-x. 5 ec2-user ec2-user 113 Dec  9 17:28 venv

Django/venv目录：

drwxr-xr-x. 2 ec2-user ec2-user 4096 Dec  9 16:54 bin
srwxrwxrwx. 1 ec2-user ec2-user    0 Dec  9 17:23 gunicorn.sock
drwxr-xr-x. 2 ec2-user ec2-user    6 Dec  7 03:11 include
drwxr-xr-x. 3 ec2-user ec2-user   23 Dec  7 03:11 lib
lrwxrwxrwx. 1 ec2-user ec2-user    3 Dec  7 03:11 lib64 -> lib
-rwxrwxr-x. 1 ec2-user ec2-user   44 Dec  9 15:49 mysite.env
-rw-r--r--. 1 ec2-user ec2-user   70 Dec  7 03:11 pyvenv.cfg

Django/venv/bin目录：

-rw-r--r--. 1 ec2-user ec2-user 1901 Dec  7 03:12 activate
-rw-r--r--. 1 ec2-user ec2-user  850 Dec  7 03:12 activate.csh
-rw-r--r--. 1 ec2-user ec2-user 1990 Dec  7 03:12 activate.fish
-rw-r--r--. 1 ec2-user ec2-user 8834 Dec  7 03:12 Activate.ps1
-rwxr-xr-x. 1 ec2-user ec2-user  285 Dec  7 03:21 django-admin
-rwxr-xr-x. 1 ec2-user ec2-user  239 Dec  9 16:54 gunicorn
-rwxr-xr-x. 1 ec2-user ec2-user  236 Dec  7 03:21 markdown_py
-rwxr-xr-x. 1 ec2-user ec2-user  243 Dec  7 03:22 pip
-rwxr-xr-x. 1 ec2-user ec2-user  243 Dec  7 03:22 pip3
-rwxr-xr-x. 1 ec2-user ec2-user  243 Dec  7 03:22 pip3.11
-rwxr-xr-x. 1 ec2-user ec2-user  243 Dec  7 03:22 pip3.9
lrwxrwxrwx. 1 ec2-user ec2-user    7 Dec  7 03:11 python -> python3
lrwxrwxrwx. 1 ec2-user ec2-user   16 Dec  7 03:11 python3 -> /usr/bin/python3
lrwxrwxrwx. 1 ec2-user ec2-user    7 Dec  7 03:11 python3.9 -> python3
-rwxr-xr-x. 1 ec2-user ec2-user  238 Dec  7 03:17 sqlformat
-rwxr-xr-x. 1 ec2-user ec2-user  230 Dec  7 03:20 wheel

/etc/systemd/system目录：

-rw-r--r--. 1 root root  327 Dec  9 17:42  gunicorn.service
drwxr-xr-x. 2 root root 4096 Dec  9 15:46  multi-user.target.wants

问题原因分析 #

1. SELinux限制：CentOS Stream 9默认开启SELinux强制模式，systemd进程属于系统上下文，无法访问用户主目录（/home/ec2-user）下的文件，即使文件权限配置正确。这是触发权限拒绝的核心原因。
2. 目录权限链缺失：访问文件需要所有父目录具备执行权限（x），若/home/ec2-user或/home/ec2-user/Django目录的执行权限未对ec2-user开放，也会导致无法读取文件。

解决方案 #

方案1：临时关闭SELinux测试（仅用于验证） #

执行以下命令临时关闭SELinux：

setenforce 0

然后重新启动gunicorn服务：

systemctl daemon-reload
systemctl start gunicorn.service

若服务正常启动，说明SELinux是问题根源。

方案2：永久配置SELinux规则（推荐） #

步骤1：为Gunicorn可执行文件添加SELinux上下文

semanage fcontext -a -t httpd_sys_script_exec_t "/home/ec2-user/Django/venv/bin/gunicorn"
restorecon -v "/home/ec2-user/Django/venv/bin/gunicorn"

步骤2：为项目目录添加SELinux上下文

semanage fcontext -a -t httpd_sys_content_t "/home/ec2-user/Django/Django_Project(/.*)?"
restorecon -Rv "/home/ec2-user/Django/Django_Project"

步骤3：允许httpd进程连接到Unix Socket

setsebool -P httpd_can_network_connect_unix on

步骤4：重启服务

systemctl daemon-reload
systemctl restart gunicorn.service

方案3：检查并修复父目录权限 #

执行以下命令确保父目录具备执行权限：

chmod +x /home/ec2-user
chmod +x /home/ec2-user/Django

然后重新启动服务验证。

内容的提问来源于stack exchange，提问作者It's a Doge