Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 939560 - www-servers/nginx: it's problematic to run nginx completely rootless because NGINX_PIDFILE makes no effect
Summary: www-servers/nginx: it's problematic to run nginx completely rootless because ...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: No maintainer - Look at https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers if you want to take care of it
URL:
Whiteboard:
Keywords: PullRequest
Depends on:
Blocks:
 
Reported: 2024-09-13 04:35 UTC by Alexander Lopatin
Modified: 2024-11-04 09:27 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (emerge-info.txt,24.09 KB, text/plain)
2024-09-13 04:36 UTC, Alexander Lopatin
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Lopatin 2024-09-13 04:35:00 UTC
# grep NGINX_PIDFILE /etc/conf.d/nginx
NGINX_PIDFILE="/run/nginx/nginx.pid"

# /etc/init.d/nginx --verbose start
 * Caching service dependencies ...                                                      [ ok ]
 * Executing: /lib/rc/sh/openrc-run.sh /lib/rc/sh/openrc-run.sh /etc/init.d/nginx start
 * Checking nginx' configuration ...                                                     [ ok ]
 * Starting nginx ...
 * start-stop-daemon: fopen `/run/nginx/nginx.pid': No such file or directory
 * Detaching to start `/usr/sbin/nginx' ...
 *   start-stop-daemon: fopen `/run/nginx/nginx.pid': No such file or directory
 *   start-stop-daemon: did not create a valid pid in `/run/nginx/nginx.pid'
 * Failed to start nginx                                                                 [ !! ]
 * ERROR: nginx failed to start

This makes nginx problematic to run completely rootless.

Normally this supposed to work (for instance it works in Alpine Linux):

echo 'command_user="nginx"' >> /etc/conf.d/nginx
setcap CAP_NET_BIND_SERVICE=+eip /usr/sbin/nginx
# NGINX_PIDFILE is already set to location writable by user nginx in Alpine Linux
/etc/init.d/nginx start
ps uax | grep nginx | grep -v grep # none of the processes are running by root

It seems to be hardcoded at "configure" step with "--pid-path" in both distributions.

To mitigate this issue it seems we can make "/run/nginx/nginx.pid" a default pid file (where "nginx:nginx" owns "/run/nginx", same as in Alpine).


Reproducible: Always
Comment 1 Alexander Lopatin 2024-09-13 04:36:09 UTC
Created attachment 902813 [details]
emerge --info
Comment 2 Larry the Git Cow gentoo-dev 2024-10-17 07:35:55 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=108a642ef4da9fa6ae4f0d33580a05cea3f70678

commit 108a642ef4da9fa6ae4f0d33580a05cea3f70678
Author:     Alexander Lopatin <alopatindev@codonaft.com>
AuthorDate: 2024-09-13 17:01:51 +0000
Commit:     Joonas Niilola <juippis@gentoo.org>
CommitDate: 2024-10-17 07:35:53 +0000

    www-servers/nginx: fix directory path to pid file
    
    Closes: https://bugs.gentoo.org/939560
    Signed-off-by: Alexander Lopatin <alopatindev@codonaft.com>
    Closes: https://github.com/gentoo/gentoo/pull/38593
    Signed-off-by: Joonas Niilola <juippis@gentoo.org>

 www-servers/nginx/files/nginx.confd        | 5 ++++-
 www-servers/nginx/files/nginx.initd-r4     | 4 +++-
 www-servers/nginx/files/nginx.logrotate-r1 | 2 +-
 www-servers/nginx/files/nginx.service-r1   | 2 +-
 www-servers/nginx/nginx-1.26.2-r3.ebuild   | 2 +-
 www-servers/nginx/nginx-1.27.2.ebuild      | 2 +-
 6 files changed, 11 insertions(+), 6 deletions(-)
Comment 3 Larry the Git Cow gentoo-dev 2024-10-19 14:44:42 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6f136d56a588639697e42a27391f83483d333e0e

commit 6f136d56a588639697e42a27391f83483d333e0e
Author:     Louis Sautier <sbraz@gentoo.org>
AuthorDate: 2024-10-19 14:36:26 +0000
Commit:     Louis Sautier <sbraz@gentoo.org>
CommitDate: 2024-10-19 14:44:24 +0000

    www-servers/nginx: fix systemd unit to create /run/nginx/ (#941784)
    
    108a642ef4da broke the systemd service, by moving the PID file to
    /run/nginx/ without creating the directory, resulting in 'open()
    "/run/nginx/nginx.pid" failed (2: No such file or directory)'
    
    Bug: https://bugs.gentoo.org/939560
    Closes: https://bugs.gentoo.org/941784
    Signed-off-by: Louis Sautier <sbraz@gentoo.org>

 www-servers/nginx/files/nginx.service-r1                             | 1 +
 www-servers/nginx/{nginx-1.26.2-r3.ebuild => nginx-1.26.2-r4.ebuild} | 0
 www-servers/nginx/{nginx-1.27.2.ebuild => nginx-1.27.2-r1.ebuild}    | 0
 3 files changed, 1 insertion(+)
Comment 4 gt_amd64 2024-10-19 16:29:18 UTC
i did not had this issue until i just updated to -r4!
with -r4 i get this error: did not create a valid pid in `/run/nginx/nginx.pid'
and i landed here, so this patch does not fix an error, it actually produces an error! (i created an overlay, reverted back to -r3 and the error is gone!)

i have this line in etc/nginx.conf
pid /run/nginx.pid;
Comment 5 gt_amd64 2024-10-19 16:36:57 UTC
please reopen - needs fix!
Comment 6 Alexander Lopatin 2024-10-19 18:12:01 UTC
/run/nginx.pid is not a valid path anymore, it's a hardcoded value that has been changed to /run/nginx/nginx.pid due to original issue https://bugs.gentoo.org/939560#c0

Does it work for you if you change /run/nginx.pid to /run/nginx/nginx.pid in nginx.conf?
Comment 7 gt_amd64 2024-10-21 15:31:08 UTC
Just installed -r5 and changed nginx.conf to "pid /run/nginx/nginx.pid;"
Now start/stop/restart works fine - Thanks!