0

I'm writing a systemd service file for nginx and an internet facing service running as root is a bad idea, however I need nginx to access a certain directory in each user's home directory.

e.g.

/home/user1/static /home/user2/static

However I don't want anyone else but nginx (and root) to be able to access user directories.

And there is the dilemma.

/home/user1 and subdirs need to be owned by user1:user1 just in case one user gets compromised.

That means, unless I'm missing something, that nginx needs to be ran as root. GOTO 10.

And because of that, it needs access to some directories. Its configuration directory for instance /etc/nginx in this case. But also other directories. And my question is which directories are those?

  • Why are you writing a systemd unit file when there are good ones included in most systemd-enabled distributions already? – Michael Hampton Jan 15 '15 at 18:57
  • Because the default service files aren't specific to my needs, e.g. seccomp stuff, readonly/write/inaccessible directories configured, dropped caps. If you had read the question you wouldn't need to ask. – user171555 Jan 16 '15 at 0:12
0

Nginx would need read on /home/user#/static.

Each user would be responsible for making sure nginx can read the directory.

By default nginx READS from

/etc/nginx and subdirectories

nginx only WRITES where it is configured to, such as configured log files (often in /var/log/nginx).

remember to check your init script for the '-g' parameter, which can include some extra options (such as what PID file to use)

Also, nginx is usually started as root, and drops to a configured user later.

0

As a workaround you can:

  1. Set 750 permissions on /home/user1, /home/user2, etc directories and for ~/static dir for every user.

  2. If nginx workers are running under nginx:nginx you can add all your users to group nginx and nginx now will be able to access /home/user1/static, /home/user2/static, etc

Of course this is not a good practice to set 750 on home dir, but in this case you have no other way because if you will run nginx under root it will be able to access entire system, not only your user dirs, maybe some private keys and other critical things.

And there is also another way to do this:

  1. Create directories somewhere else, for example /srv/user1, /srv/user2, set for them permissions 750 and user1:nginx, user2:nginx owners:groups. So nginx can easily read from this dirs.
  2. Create a symlinks to this dirs:

    /home/user1/static -> /srv/user1

    /home/user2/static -> /srv/user2

    so user can easy access and modify them while rights for home dirs for users left 700.

So it's not workaround, but solution. And you won't have to run nginx as root.

  • I would use mount --bind instead of symlinks. 1up for the idea. – user171555 Jan 16 '15 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy