I am running CentOS 7.7 and I want to run Nginx under custom user with custom www and log locations. I have already hit SELinux so I enabled my custom directories:
semanage permissive -a httpd_t # temporarily make SELinux permissive
semanage fcontext -a -t httpd_sys_content_t '/opt/x/data/nginx(/.*)?'
restorecon -R -v /opt/x/data/nginx
semanage fcontext -a -t httpd_log_t '/opt/x/log/nginx(/.*)?'
restorecon -R -v /opt/x/log/nginx
This is my nginx.conf:
user Xnginx Xgrp;
worker_processes auto;
error_log /opt/x/log/nginx/error.log;
pid /run/nginx.pid;
And the directory rights:
ls -lZ /opt/X/log/
drwxrwxr-x. Xnginx Xgrp unconfined_u:object_r:httpd_log_t:s0 nginx
I start Nginx with
systemctl start nginx
And it gives
[root@RE1 nginx]# systemctl status nginx
nginx.service - The nginx HTTP and reverse proxy server
Loaded: loaded (/usr/lib/systemd/system/nginx.service; disabled; vendor preset: disabled)
Active: active (running) since Wed 2020-05-06 09:15:06 CEST; 12min ago
Process: 109185 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
Process: 109182 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
Process: 109180 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
Main PID: 109187 (nginx)
CGroup: /system.slice/nginx.service
├─109187 nginx: master process /usr/sbin/nginx
├─109188 nginx: worker process
├─109189 nginx: worker process
├─109190 nginx: worker process
└─109191 nginx: worker process
May 06 09:15:06 RE1 systemd[1]: Starting The nginx HTTP and reverse proxy server...
May 06 09:15:06 RE1 nginx[109182]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
May 06 09:15:06 RE1 nginx[109182]: nginx: configuration file /etc/nginx/nginx.conf test is successful
May 06 09:15:06 RE1 systemd[1]: Started The nginx HTTP and reverse proxy server.
I can see the subprocesses running under the user while the master process run as root
1 0 109187 1 20 0 131148 2268 sigsus Ss ? 0:00 nginx: master process /usr/sbin/nginx
5 603 109188 109187 20 0 133632 3544 ep_pol S ? 0:00 \_ nginx: worker process
5 603 109189 109187 20 0 133632 3544 ep_pol S ? 0:00 \_ nginx: worker process
5 603 109190 109187 20 0 133632 3544 ep_pol S ? 0:00 \_ nginx: worker process
5 603 109191 109187 20 0 133632 3544 ep_pol S ? 0:00 \_ nginx: worker process
And finally the problem:
ls -lZ /opt/X/log/nginx/
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 access.log
-rw-r--r--. root root system_u:object_r:httpd_log_t:s0 error.log
The files were supposed to be owned by Xnginx, not root. Why?