The systemd unit file that comes with the nginx-common package runs the master process as root, which makes me nervous.
I assume the only reason it runs as root is to bind port 80, but being root is overkill for that, so I am running it as a normal user and giving it the
I have tweaked the unit file to look like this:
[Service] Type=forking PIDFile=/var/run/nginx/nginx.pid ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;' ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;' ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload ExecStop=/usr/sbin/nginx -s quit CapabilityBoundingSet=CAP_NET_BIND_SERVICE Capabilities=cap_net_bind_service+=ep user=www-data
Are there any downsides to this approach? Does nginx expect to be root for some other reason? Is there a better way to lock down nginx? I know some people like to chroot it but that seems like a lot of hassle.