801370 – www-servers/nginx: Entirely running as non-root via capabilities

Bug 801370 - www-servers/nginx: Entirely running as non-root via capabilities

Summary: www-servers/nginx: Entirely running as non-root via capabilities

Status:	CONFIRMED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	Current packages (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	No maintainer - Look at https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers if you want to take care of it

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2021-07-09 18:40 UTC by Haelwenn (lanodan) Monnier
Modified:	2022-06-05 08:14 UTC (History)
CC List:	3 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Haelwenn (lanodan) Monnier 2021-07-09 18:40:33 UTC

I wanted to introduce IUSE=caps to nginx with:
1. The nginx binary chmod 0500 + chown nginx + CAP_NET_BIND_SERVICE
2. openrc+systemd launching it directly as the nginx user

But with how large the ebuild for nginx already is I wondered if it wouldn't be better to make that the default instead?

btw 1. is done this way because https://github.com/OpenRC/openrc/issues/314 hasn't got a merged fix yet.

I can write and send a tested patch with OpenRC, I done the change manually outside of the ebuild some months back on one of my systems and it worked pretty well.