问根用户出现nginx 403禁止错误

EN

➜  ~ tail -fn4 /var/log/nginx/error.log
2016/04/23 08:16:51 [error] 10488#0: *1 open() "/data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css" failed (13: Permission denied), client: x.x.x.x, server: www.xx.com, request: "GET /static/css/main.css HTTP/1.1", host: "xx.com"
2016/04/23 08:16:53 [error] 10488#0: *1 open() "/data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css" failed (13: Permission denied), client: x.x.x.x, server: www.xx.com, request: "GET /static/css/main.css HTTP/1.1", host: "xx.com"
2016/04/23 08:21:48 [error] 10488#0: *4 open() "/data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css" failed (13: Permission denied), client: x.x.x.x, server: www.xx.com, request: "GET /static/css/main.css HTTP/1.1", host: "xx.com"
2016/04/23 08:24:49 [error] 10488#0: *5 open() "/data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css" failed (13: Permission denied), client: x.x.x.x, server: www.xx.com, request: "GET /static/css/main.css HTTP/1.1", host: "xx.com"

➜  ~ namei -l /data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css
f: /data/apache-tomcat-8.0.33/webapps/ROOT/static/css/main.css
drwxr-xr-x root root /
drwxr-xr-x root root data
drwxr-xr-x root root apache-tomcat-8.0.33
drwxr-xr-x root root webapps
drwxr-xr-x root root ROOT
drwxr-xr-x root root static
drwxr-xr-x root root css
-rw-r--r-- root root main.css

➜  ~ ps aux | grep "nginx: worker process" | awk '{print $1}'
root

   upstream tomcat {
       server 127.0.0.1:8887;
   }


 server {
    listen       80;
    server_name  www.xx.com xx.com;


    charset utf-8;
    access_log  /var/log/nginx/tomcat.access.log  main;

    location / {

        proxy_pass        http://tomcat;
        proxy_redirect off;
        client_max_body_size 500M;

        proxy_set_header  Host  $host;
        proxy_set_header  X-Real-IP  $remote_addr;
        proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;

    }

    location ~ .*\.(gif|jpg|jpeg|bmp|png|ico|txt|js|css)$
    {
        root /data/apache-tomcat-8.0.33/webapps/ROOT;
        expires      7d;
    }

    location ~ ^/(WEB-INF)/ {
        deny all;
    }

}