{"record":{"id":"343d6f6d60d7c9f0","repo":"nginx/nginx","slug":"ngx-log-crit-343d6f","errorCode":"NGX_LOG_CRIT","errorMessage":"<ngx_open_file_n> \\\"%s\\\" failed","messagePattern":"<ngx_open_file_n> \\\\\"(.+?)\\\\\" failed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/stream/ngx_stream_geo_module.c","lineNumber":1371,"sourceCode":"    ngx_err_t                     err;\n    ngx_int_t                     rc;\n    ngx_uint_t                    i;\n    ngx_file_t                    file;\n    ngx_file_info_t               fi;\n    ngx_stream_geo_range_t       *range, **ranges;\n    ngx_stream_geo_header_t      *header;\n    ngx_stream_variable_value_t  *vv;\n\n    ngx_memzero(&file, sizeof(ngx_file_t));\n    file.name = *name;\n    file.log = cf->log;\n\n    file.fd = ngx_open_file(name->data, NGX_FILE_RDONLY, NGX_FILE_OPEN, 0);\n\n    if (file.fd == NGX_INVALID_FILE) {\n        err = ngx_errno;\n        if (err != NGX_ENOENT) {\n            ngx_conf_log_error(NGX_LOG_CRIT, cf, err,\n                               ngx_open_file_n \" \\\"%s\\\" failed\", name->data);\n        }\n        return NGX_DECLINED;\n    }\n\n    if (ctx->outside_entries) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n            \"binary geo range base \\\"%s\\\" cannot be mixed with usual entries\",\n            name->data);\n        rc = NGX_ERROR;\n        goto done;\n    }\n\n    if (ctx->binary_include) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n            \"second binary geo range base \\\"%s\\\" cannot be mixed with \\\"%s\\\"\",\n            name->data, ctx->include_name.data);\n        rc = NGX_ERROR;","sourceCodeStart":1353,"sourceCodeEnd":1389,"githubUrl":"https://github.com/nginx/nginx/blob/3f6f7824d4e2eb1ac37dec76683d525ac0ff521c/src/stream/ngx_stream_geo_module.c#L1353-L1389","documentation":"Logged by ngx_stream_geo_include_binary_base(): opening the precompiled range base file ('<include>.bin') with ngx_open_file() failed with an errno other than NGX_ENOENT - typically EACCES. Missing files (ENOENT) are silent because the normal case is 'no .bin yet'. The function returns NGX_DECLINED so nginx falls back to parsing the text include file; startup only fails if that also fails.","triggerScenarios":"A `<name>.bin` exists next to the include file but the master process user cannot open it (permission bits, non-searchable parent directory, SELinux/AppArmor denial), so ngx_open_file() returns NGX_INVALID_FILE with err != NGX_ENOENT.","commonSituations":"The .bin was generated by root with restrictive umask while nginx runs as another user; security modules blocking access; containers with read-only or odd permission mounts.","solutions":["Check the exact path printed in the message and run `ls -l <file>.bin` and `sudo -u <nginx-user> cat <file>.bin` to confirm readability","Fix permissions: `chown <nginx-user> <file>.bin; chmod 644 <file>.bin` (and +x on parent dirs)","Adjust SELinux context (`restorecon`) or the AppArmor profile if applicable","As a workaround delete the .bin - nginx re-parses the text file and regenerates it"],"exampleFix":"# before: .bin written by root with 600\n$ ls -l /etc/nginx/geo/geo.conf.bin\n-rw------- root root /etc/nginx/geo/geo.conf.bin\n\n# after: readable by master process user\n$ chown nginx:nginx /etc/nginx/geo/geo.conf.bin\n$ chmod 644 /etc/nginx/geo/geo.conf.bin","handlingStrategy":"validation","validationCode":"# pre-flight: master-process user must be able to read text + .bin\nfor f in /etc/nginx/geo/*.conf /etc/nginx/geo/*.conf.bin; do\n  [ -e \"$f\" ] && sudo -u nginx test -r \"$f\" || echo \"UNREADABLE: $f\"\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set ownership/permissions on the conf directory and geo files in your deploy script","Beware umask when generating .bin files as root","Check SELinux/AppArmor contexts after moving geo files"],"tags":["nginx","stream","geo","file-permissions","include"],"backgroundTag":"file-open-failed","analyzedSha":"3f6f7824d4e2eb1ac37dec76683d525ac0ff521c","analyzedAt":"2026-08-22T03:09:46.447Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}