When umask is more restrictive than default, 0022 vs 0027, /var/www/cgi-bin/nova is created with insufficient permissions. [root@new-deployment ~]# umask 0027 [root@new-deployment conf.d]# ls -las /var/www/cgi-bin/nova total 12 4 drwxr-x---. 2 nova nova 4096 ago 29 10:11 . 4 drwxr-xr-x. 4 root root 4096 ago 29 10:12 .. 4 -rw-r--r--. 1 nova nova 1252 ago 29 10:11 nova-api [root@new-deployment ~]# nova list ERROR (Forbidden): Forbidden (HTTP 403) [root@new-deployment ~]# grep AH00035 /var/log/httpd/nova_api_wsgi_access.log [Wed Aug 29 11:05:46.352740 2018] [core:error] [pid 15972] (13)Permission denied: [client 172.28.4.3:42610] AH00035: access to /v2.1 denied (filesystem path '/var/www/cgi-bin/nova/nova-api') because search permissions are missing on a component of the path [root@old-deployment ~]# umask 0022 [root@old-deployment conf.d]# ls -las /var/www/cgi-bin/nova total 4 0 drwxr-xr-x. 2 nova nova 22 feb 19 2018 . 0 drwxr-xr-x. 4 root root 34 feb 19 2018 .. 4 -rw-r--r--. 1 nova nova 1252 feb 19 2018 nova-api Fix file permissions: [root@new-deployment conf.d]# chmod 755 /var/www/cgi-bin/nova [root@new-deployment conf.d]# source ~/stackrc [root@new-deployment conf.d]# nova list +----+------+--------+------------+-------------+----------+ | ID | Name | Status | Task State | Power State | Networks | +----+------+--------+------------+-------------+----------+ +----+------+--------+------------+-------------+----------+ $ egrep "python-tripleo|instack" installed-rpms instack-5.1.0-1.el7ost.noarch instack-undercloud-5.3.7-1.el7ost.noarch python-tripleoclient-5.4.6-1.el7ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0760