[SELinux] failed to listen on UNIX socket: /var/run/memcached/memcached.sock: Permission denied

-- Subject: Unit memcached.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit memcached.service has finished starting up.
--
-- The start-up result is done.
Feb 19 11:09:15 test_server polkitd[589]: Unregistered Authentication Agent for unix-process:21244:305184463 (system bus name :1.47298, object path /org/freedesktop
Feb 19 11:09:15 test_server memcached[21251]: bind(): Permission denied
Feb 19 11:09:15 test_server memcached[21251]: failed to listen on UNIX socket: /var/run/memcahced/memcached.sock: Permission denied
Feb 19 11:09:15 test_server systemd[1]: memcached.service: main process exited, code=exited, status=71/n/a
Feb 19 11:09:15 test_server systemd[1]: Unit memcached.service entered failed state.
Feb 19 11:09:15 test_server systemd[1]: memcached.service failed.
Feb 19 11:09:18 test_server dhclient[1027]: PRC: Renewing lease on eth0.
Feb 19 11:09:18 test_server dhclient[1027]: XMT: Renew on eth0, interval 10830ms.
Feb 19 11:09:18 test_server dhclient[1027]: RCV: Reply message on eth0 from fe80:....

  tmpfs 공간에 memcached 유닉스 소켓 파일을 만들려는데 SELinux 정책 때문에 권한이 없어 memcached 실행이 막힌 경우이다. tmpfs_t와 memcached_t에 memcached 유닉스 소켓 파일을 만들고 다룰 수 있는 권한을 주어서 memcached가 작동하게 할 수 있다.

  [SELinux] recv() failed (104: Connection reset by peer) while reading response header from upstream...에서 이야기한 방법을 참고하여 nginx-passenger.te 파일을 만들되, nginx-passenger.te 파일에 다음 내용을 더 끼워 넣는다.

module nginx-passenger 1.0;
require {
...
        type httpd_t;
        type memcached_t;
        type tmpfs_t;
...
        class dir { ... getattr add_name remove_name };
        class sock_file { create getattr unlink write };
...
#============= httpd_t ==============
allow httpd_t tmpfs_t:sock_file { write };
...
#============= memcached_t ==============
allow memcached_t tmpfs_t:dir { add_name remove_name write };
allow memcached_t tmpfs_t:sock_file { create getattr unlink };
...

# checkmodule -M -m -o nginx-passenger.mod nginx-passenger.te
checkmodule:  loading policy configuration from nginx-passenger.te
checkmodule:  policy configuration loaded
checkmodule:  writing binary representation (version 19) to nginx-passenger.mod

# semodule_package -o nginx-passenger.pp -m nginx-passenger.mod
# semodule -i nginx-passenger.pp