How to make NGinx to ignore file permissions? [closed]

Question

I use NGinx to serve static sites, and sometimes there are some files with 640 permissions instead of 644. For such sites NGinx says "403 Forbidden".

Is there any way to tell NGinx to ignore file permissions and serve any file in the public directory?

P.S.

Yes, I can change the file permissions with chmod, but it happens frequently and I got tired of it.

Also, I'm aware about the possible security breach, but in this case I don't care about it, any file inside of public folder supposed to be available for everyone.

Answer 1

Your question is nonsense.

The user/group pair assigned to nginx worker process(es) is defined with the user directive. Change it so it has read access in relation to your OS users and groups.

Answer 2

The file permissions are at the os level not at nginx. so you need to make whatever puts the files into the directory update the permissions or you need to change nginx so it runs as a user/group that has permissions to read the file.

Answer 3

Only processes owned by root can have access to everything regardless of permissions. nginx really should not be run as root.

What you can do is change the ACLs for a directory and its contents, so that one or more users or groups can have read access regardless of the file permissions. You should read man setfacl before playing around with it, but here's a short instruction:

First, take a backup of the current permissions:

sudo getfacl -R /path/to/public_dir > /tmp/publicacl.bak

Apply read access to all existing files in /path/to/public_dir and all subdirectories

sudo setfacl -R -m u:NGINXUSR:rX /path/to/public_dir 

Set a default ACL to /path/to/public_dir and all its subdirectories which will be applied to all new files and directories created or uploaded in those directories

sudo setfacl -R -m d:u:NGINXUSR:rX /path/to/public_dir 

If anything were to go wrong, you can revert to the earlier ACLs by doing

sudo setfacl --restore=/tmp/publicacl.bak

Answer 4

simple solution would be to run a cron job to add read permission for nginx user to all the files in you public folder, any way you dont care about read permissions in public folder