The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A Django site behind Nginx and Gunicorn reports Permission denied when the Nginx worker cannot access a specific Unix-socket path, directory, file, or mandatory-access-control policy. The reliable fix is to identify that exact path, identify the user and group of both processes, check every parent directory, then grant only the required permission. Do not begin with chmod -R 777: it hides the cause and creates an unnecessary security exposure.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The fastest safe way to find the cause
Start by capturing the complete error, including the path and errno. Nginx and Gunicorn can fail for different reasons that look similar in a browser.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Read the Nginx error log while reproducing the request:
sudo tail -f /var/log/nginx/error.log - Read the Gunicorn service and socket journals:
journalctl -u gunicorn.service -u gunicorn.socket -b - Write down the exact path, service name, process identity, and error text.
- Check the path before changing any ownership or mode bits.
| Observed message | What it means | First check |
|---|---|---|
connect() to unix:/run/gunicorn.sock failed (13: Permission denied) |
Nginx reached the socket path but the operating system denied access. | Socket owner, group, mode, and traversal permission on /run and every parent directory. |
No such file or directory |
The path does not exist at the moment of the request, or a parent directory is missing. | Socket activation, service startup order, spelling, and the actual runtime path. |
Connection refused |
The socket exists, but no process is accepting connections. | Gunicorn status, worker crashes, and whether the service is listening on that socket. |
Nginx open() permission denied for /static/ or /media/ |
This is a file or directory access problem, not a Gunicorn-socket problem. | Read permission for the Nginx worker and execute permission on every parent directory. |
An HTTP 502 page does not identify the root cause by itself. The errno in the Nginx log does.
Confirm which users and groups are involved
Linux evaluates access using the identity of the process making the request. The account that starts a service is not necessarily the account that handles requests.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Find the Nginx worker identity
Inspect the running workers rather than assuming a distribution-specific name:
ps -eo user,group,pid,cmd | grep '[n]ginx: worker'Common accounts include www-data, nginx, and http, but none is universal. The user directive in the Nginx configuration can also define the worker account.
Recommended Free Tools
Find the Gunicorn service identity
systemctl show gunicorn.service -p User -p Group -p WorkingDirectory -p ExecStart
systemctl cat gunicorn.serviceGunicorn can select worker credentials with --user and --group. Its settings documentation states that --user switches worker processes to the selected user, --group selects the worker group, and “Note that this affects unix socket permissions.” A service can therefore start successfully while producing a socket that Nginx cannot open.
Record the effective identities in a small map:
- Nginx worker: the account that connects to the socket and reads static files.
- Gunicorn worker: the account that runs Django code and may create the socket, logs, uploads, or generated files.
- Socket owner and group: the credentials assigned when the socket is created.
Inspect the complete path, not just the final file
For /run/gunicorn.sock, Nginx must be allowed to traverse / and /run, then access the socket itself. A permissive socket mode cannot compensate for a parent directory without the execute bit.
ls -l /run/gunicorn.sock
namei -l /run/gunicorn.sock
stat -c '%A %a %U:%G %n' /run /run/gunicorn.sock
systemctl status gunicorn.service gunicorn.socketnamei -l is particularly useful because it displays ownership and mode for every component of the path. For each directory, the Nginx account needs execute (x) permission to traverse it. To list a directory, it also needs read (r); to serve a known file, traversal plus read access to the file is the critical combination.
If the socket is a symbolic link, inspect the target as well. A service may recreate the target after every reboot, so check the resulting path after restarting rather than trusting a previous listing.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Set Unix-socket ownership and mode deliberately
A Unix socket has an owner, group, and mode just like a regular file. The usual least-privilege arrangement gives Nginx group access while keeping unrelated users out.
| Socket setting | Purpose | Typical decision |
|---|---|---|
| Owner | Account that owns the socket inode. | The service account or the account deliberately assigned by systemd. |
| Group | Shared access boundary for the proxy and application. | A group containing the Nginx worker; often the web-service group. |
| Mode | Read/write permission on the socket. | 0660 for owner and group, with no access for others, when both processes are in the intended group. |
| Parent directories | Traversal to reach the socket. | Execute permission for the Nginx account or its group on every parent. |
Do not blindly change the socket to world-writable. If the Nginx worker is not in the socket group, add it to the intentionally chosen group, restart the relevant service so the new supplementary group is effective, and verify with id.
Choose who creates the socket
There are two valid designs. The important rule is that ownership and mode must be applied by the component that actually creates the socket.
| Design | Who creates the socket | How permissions are controlled | Operational characteristic |
|---|---|---|---|
| Gunicorn-created socket | Gunicorn opens the Unix-socket path. | Gunicorn’s --user, --group, and --umask, plus the writable runtime directory. |
The command must recreate the socket with the right mode after every restart. |
| systemd-created socket | A .socket unit creates and owns the listening endpoint. |
SocketUser, SocketGroup, and SocketMode in the socket unit. |
systemd can recreate the endpoint during boot and start Gunicorn on demand. |
Gunicorn documents that its --umask affects Unix-socket permissions. When Gunicorn creates the socket, inspect the actual result with ls -l; do not infer the final mode from the command line alone.
Example: a systemd socket unit
Create or edit a unit such as /etc/systemd/system/gunicorn.socket with values that match the accounts on your host:
[Unit]
Description=Gunicorn socket
[Socket]
ListenStream=/run/gunicorn.sock
SocketUser=www-data
SocketGroup=www-data
SocketMode=0660
[Install]
WantedBy=sockets.targetThe documented deployment pattern uses SocketUser=www-data, SocketGroup=www-data, and SocketMode=0660, then tests the endpoint as the Nginx user. If your Nginx workers use another account, substitute that account or place it in the selected group.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Align the service unit
The companion service must declare the account that runs Django and the project directory required by the application:
[Service]
User=django
Group=www-data
WorkingDirectory=/srv/myprojectKeep the existing ExecStart command for your project, but make sure it uses the same socket-activation design as the socket unit. Do not have systemd create /run/gunicorn.sock while a separate Gunicorn command independently tries to create the same path. If Gunicorn itself is responsible for binding, remove the conflicting socket unit or change the command and path consistently.
Reload and verify instead of assuming
sudo systemctl daemon-reload
sudo systemctl enable --now gunicorn.socket
sudo systemctl restart gunicorn.service
systemctl status gunicorn.socket gunicorn.service
ls -l /run/gunicorn.sock
namei -l /run/gunicorn.sockAfter editing a unit, a successful daemon-reload only means systemd reread the files. The status output and the resulting inode confirm whether the requested owner, group, and mode were actually applied.
Test the socket as the actual proxy user
Testing as root can produce a false success because root bypasses ordinary permission checks. Use the same account shown for the Nginx worker:
sudo -u www-data curl --unix-socket /run/gunicorn.sock http://localhost/Gunicorn’s deployment documentation demonstrates this sudo -u www-data curl --unix-socket test on Debian-style systems. Replace www-data with your worker account. A successful HTTP response proves that the connecting identity can open the socket and that Gunicorn is responding through it. If it fails, repeat namei -l and inspect the service journal before changing permissions.
Compare Unix sockets with loopback TCP
A loopback TCP bind can avoid filesystem traversal, but it changes the access-control surface rather than eliminating access control.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
| Consideration | Unix socket | Loopback TCP |
|---|---|---|
| Access control | Owner, group, mode, and every parent directory; mandatory access controls can also apply. | Port binding, firewall rules, and the process listening on the loopback address. |
| Proxy configuration | Nginx uses a unix: upstream path. |
Nginx uses an address such as 127.0.0.1:8000. |
| Reboot durability | Requires reliable recreation of the runtime path and socket. | Requires reliable service startup and a stable port. |
| Typical failure clues | EACCES, missing path, or stale socket. |
Connection refused, wrong port, or a service bound only to another address. |
Switching to TCP is a design choice, not a permission fix. If you change transports, update both Gunicorn and Nginx, then test the new endpoint and ensure the port is not exposed beyond the intended interface.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Fix Django static, media, log, and generated-file denials separately
A working Gunicorn socket does not grant Nginx access to Django’s files. Treat each denied path as an independent filesystem case.
Static files
After running Django’s collection step, inspect the configured static root and every parent directory:
namei -l /srv/myproject/staticfiles
find /srv/myproject/staticfiles -maxdepth 2 -type f -printf '%M %u:%g %pn' | headNginx needs read permission on each file it serves and execute permission on each directory in the path. A directory owned by the application account can remain private from other users unless the Nginx account receives traversal and read access through a shared group or a deliberately limited mode.
Media and uploads
Uploads are normally written by Django and read by Nginx. Give the application the write capability it needs, while granting Nginx only the read and traversal capability required to serve completed files. Avoid making the entire project tree writable by the web worker.
Logs and generated files
Determine which process writes each log, cache, report, or export. The Gunicorn worker may need write access while Nginx only needs read access, or neither process may need access if logging is handled by systemd. Check the exact directory and parent modes rather than recursively changing the project tree.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Use a shared group for a stable boundary
When both processes must access a directory, a dedicated shared group is easier to maintain than repeated one-off ownership changes. Set group ownership on only the required directory, ensure group read/write or read-only bits match the operation, and arrange for newly created files to inherit the group where appropriate. Verify the effective groups of already-running services after changing membership.
Check SELinux, AppArmor, and other mandatory controls
If Unix owner, group, mode, and traversal checks all look correct, a mandatory access-control policy may still deny the operation. Inspect the distribution’s audit and journal records at the time of the failure, identify the profile or label involved, and change policy only for the recorded operation and path.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Do not copy a generic SELinux or AppArmor rule from an unrelated distribution.
- Confirm whether the denial concerns the socket, a parent directory, a static file, or a log.
- After a policy change, reproduce the request and verify that the new audit record is gone without granting unrelated access.
Policy names, labels, and service profiles differ by distribution and installation, so the local denial record is the authoritative starting point.
Common fixes that fail, and why
Running chmod -R 777
This grants every local user read, write, and execute access, often across secrets, uploaded content, and application code. It can also leave the real problem unresolved when a parent directory, service identity, or mandatory policy is responsible. Revert broad changes and apply the smallest owner, group, mode, or policy adjustment that fixes the recorded path.
Changing only the socket’s mode
Nginx still cannot connect if it cannot traverse /run or another parent directory. Always inspect the full path with namei -l.
Changing ownership on a socket that systemd recreates
A manual chown may work until the next restart. Put the desired values in SocketUser, SocketGroup, and SocketMode, reload units, restart, and verify the recreated inode.
Assuming the Nginx username
www-data is common but not universal. Use the running worker identity and the active configuration.
Fixing the socket when the denial is for a static file
Read the path in the error message. A denial under /static/ or /media/ requires file and directory access checks, not a socket change.
Quick Recap
A repeatable diagnostic decision tree
- Capture the exact failure: distinguish permission denied from missing path, refused connection, and file
open()denial. - Confirm identities: record Nginx’s worker user and Gunicorn’s configured service user and group.
- Inspect every path component: use
namei -lfor the socket or denied file. - Align ownership and mode: use a shared group and a restrictive mode such as
0660where both processes need socket access. - Make creation durable: configure systemd socket ownership or Gunicorn’s group and umask, depending on which component creates the endpoint.
- Reload and verify: run
daemon-reloadwhen units change, restart as needed, and inspect the resulting inode. - Test as Nginx: use the Unix-socket
curlcommand with the actual worker account. - Handle Django paths independently: check static, media, logs, and generated files according to the operation each process performs.
- Escalate to mandatory controls: inspect local SELinux or AppArmor audit records only after ordinary Unix permissions are correct.
Prevent the error after the next reboot
- Keep the socket under a systemd-managed runtime arrangement or another mechanism that recreates it consistently.
- Document the intended Nginx worker account, Gunicorn account, shared group, socket path, and mode.
- Include
systemctl status,ls -l, andnamei -lchecks in deployment verification. - Test through the socket as the proxy user, not as root.
- Keep static and media directories outside private application paths when that simplifies read-only serving.
- Review service and policy changes after upgrades because distribution defaults and confinement profiles can change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
