Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 801370

Summary: www-servers/nginx: Entirely running as non-root via capabilities
Product: Gentoo Linux Reporter: Haelwenn (lanodan) Monnier <contact>
Component: Current packagesAssignee: Thomas Deutschmann <whissi>
Status: CONFIRMED ---    
Severity: normal CC: emily.rowlands+gentoo, hydrapolic, sam
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---

Description Haelwenn (lanodan) Monnier 2021-07-09 18:40:33 UTC
I wanted to introduce IUSE=caps to nginx with:
1. The nginx binary chmod 0500 + chown nginx + CAP_NET_BIND_SERVICE
2. openrc+systemd launching it directly as the nginx user

But with how large the ebuild for nginx already is I wondered if it wouldn't be better to make that the default instead?

btw 1. is done this way because https://github.com/OpenRC/openrc/issues/314 hasn't got a merged fix yet.

I can write and send a tested patch with OpenRC, I done the change manually outside of the ebuild some months back on one of my systems and it worked pretty well.