Nginx, why Access to the script?

Question

PHP

Hello!
There is a task to transfer a site from a FreeBSD 9.2 server to Ubuntu 14.04.
On the old server, the virtual host looks like this:

server {
  listen       80;
        server_name  bo.aa *.bo.aa;
        if ($host ~* www\.(.*)) {
        set $host_without_www $1;
        rewrite ^(.*)$ http://$host_without_www$1 permanent; # $1 contains '/foo', not 'www.mydomain.com/foo'
        }
        root /usr/local/www/html;
        index index.php;
        charset utf-8;
        server_tokens off;

  try_files $uri @php_index;

 location @php_index {
 root /usr/local/www/html;
 fastcgi_pass 127.0.0.1:9000;
 fastcgi_buffer_size 15m;
 fastcgi_buffers 4 15m;
 fastcgi_index index.php;
 fastcgi_param SCRIPT_FILENAME /usr/local/www/html/index.php;
 include fastcgi_params;
 fastcgi_param SCRIPT_NAME /index.php;
 }
}

On ubuntu, only the path and fastcgi_pass have changed:

server {
  listen       80;
        server_name  bo.aa *.bo.aa;
        if ($host ~* www\.(.*)) {
        set $host_without_www $1;
        rewrite ^(.*)$ http://$host_without_www$1 permanent; # $1 contains '/foo', not 'www.mydomain.com/foo'
        }
        root /usr/share/nginx/www;
        index index.php;
        charset utf-8;
        server_tokens off;

  try_files $uri @php_index;

 location @php_index {
 root /usr/share/nginx/www;
 fastcgi_pass unix:/var/run/php5-fpm.sock;
 fastcgi_buffer_size 15m;
 fastcgi_buffers 4 15m;
 fastcgi_index index.php;
 fastcgi_param SCRIPT_FILENAME /usr/share/nginx/www/index.php;
 include fastcgi_params;
 fastcgi_param SCRIPT_NAME /index.php;
 }
}

But in the browser it gives an error: Access denied.
And in the log:

2015/09/06 21:52:11 [error] 18881#0: *1 FastCGI sent in stderr: "Access to the script '/usr/share/nginx/www' has been denied (see security.limit_extensions)" while reading response header from upstream, client: 192.168.0.19, server: bo.aa, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:", host: "bo.aa"

But when I replace the lines:

try_files $uri @php_index;

 location @php_index {

that 's
location ~ \.php$ {
all right.
Can someone explain why this error is thrown?

Answer 1

Apparently FPM does not have rights to the specified folder/script.