|Summary:||www-servers/nginx: Entirely running as non-root via capabilities|
|Product:||Gentoo Linux||Reporter:||Haelwenn (lanodan) Monnier <contact>|
|Component:||Current packages||Assignee:||Thomas Deutschmann <whissi>|
|Severity:||normal||CC:||emily.rowlands+gentoo, hydrapolic, sam|
|Package list:||Runtime testing required:||---|
Description Haelwenn (lanodan) Monnier 2021-07-09 18:40:33 UTC
I wanted to introduce IUSE=caps to nginx with: 1. The nginx binary chmod 0500 + chown nginx + CAP_NET_BIND_SERVICE 2. openrc+systemd launching it directly as the nginx user But with how large the ebuild for nginx already is I wondered if it wouldn't be better to make that the default instead? btw 1. is done this way because https://github.com/OpenRC/openrc/issues/314 hasn't got a merged fix yet. I can write and send a tested patch with OpenRC, I done the change manually outside of the ebuild some months back on one of my systems and it worked pretty well.