How can I run fastcgi through nginx as user ww-data?

Question

My django app saves images and they're being saved as nobody:nobody instead of www-data: like they previously were under a different server. nginx is setup as user www-data and I ran the manage.py runfcgi as root so permission shouldn't be an issue.

Answer 1

Check ps waux. My suspicion is that your manage.py runfcgi has dropped privileges to a different user to make sure that you are not running scripts as root - a very dangerous thing to do.

If that is the case, the solution is as simple as editing the configuration for however you are managing your fcgi instances and having it use www-data:www-data as the user and group that it drops privileges to instead of nobody.

Answer 2

Running django in fastcgi must be stopped and started by user code, if you call ./manage.py runfcgi your user will own the process. If you are running this from a startup job root will own the process, which is bad because files and logs it writes will not be accessible to other users and processes and leaves no permissions sandbox for you app. Best practice is to launch your app with the same user as apache or the other apps that need to share files with it. If your app needs to be launched from a startup script (root context)

sudo -u youruser manage.py runfcgi

to avoid your app running as root.

You mentioned the user 'nobody' - this is the default user nginx saves files as. I suggest you make nginx use the same user as your app, your can do this by adding

user youruser;

in nginx.conf