[PATCH] Add client_body_temp_access configuration directive

[Paul Pawlowski]

# HG changeset patch
# User Paul Pawlowski <paul at mrarm.io>
# Date 1539371172 -7200
#      Fri Oct 12 21:06:12 2018 +0200
# Node ID 67cc676dbfaf56332bb6c61e635c0073c1e49907
# Parent  8b68d50090e4f134a35da60146fefd5e63770759
Add client_body_temp_access configuration directive

Adds client_body_temp_access configuration directive, which sets the unix permissions of the temporary files holding client request bodies.

This makes it possible for a process running as another user to access the files stored using client_body_temp_path and client_body_in_file_only.
This is useful when using the mentioned directives in order to have nginx store the request body to file and forward the file path to another server running on the same machine as another user.

diff -r 8b68d50090e4 -r 67cc676dbfaf contrib/vim/syntax/nginx.vim
--- a/contrib/vim/syntax/nginx.vim	Wed Oct 03 14:08:51 2018 +0300
+++ b/contrib/vim/syntax/nginx.vim	Fri Oct 12 21:06:12 2018 +0200
@@ -155,6 +155,7 @@
 syn keyword ngxDirective contained chunked_transfer_encoding
 syn keyword ngxDirective contained client_body_buffer_size
 syn keyword ngxDirective contained client_body_in_file_only
+syn keyword ngxDirective contained client_body_temp_access
 syn keyword ngxDirective contained client_body_in_single_buffer
 syn keyword ngxDirective contained client_body_temp_path
 syn keyword ngxDirective contained client_body_timeout
diff -r 8b68d50090e4 -r 67cc676dbfaf src/http/ngx_http_core_module.c
--- a/src/http/ngx_http_core_module.c	Wed Oct 03 14:08:51 2018 +0300
+++ b/src/http/ngx_http_core_module.c	Fri Oct 12 21:06:12 2018 +0200
@@ -370,6 +370,13 @@
       offsetof(ngx_http_core_loc_conf_t, client_body_temp_path),
       NULL },
 
+    { ngx_string("client_body_temp_access"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE123,
+      ngx_conf_set_access_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_core_loc_conf_t, client_body_temp_access),
+      NULL },
+
     { ngx_string("client_body_in_file_only"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
       ngx_conf_set_enum_slot,
@@ -3373,6 +3380,7 @@
     clcf->if_modified_since = NGX_CONF_UNSET_UINT;
     clcf->max_ranges = NGX_CONF_UNSET_UINT;
     clcf->client_body_in_file_only = NGX_CONF_UNSET_UINT;
+    clcf->client_body_temp_access = NGX_CONF_UNSET_UINT;
     clcf->client_body_in_single_buffer = NGX_CONF_UNSET;
     clcf->internal = NGX_CONF_UNSET;
     clcf->sendfile = NGX_CONF_UNSET;
@@ -3594,6 +3602,8 @@
     ngx_conf_merge_uint_value(conf->client_body_in_file_only,
                               prev->client_body_in_file_only,
                               NGX_HTTP_REQUEST_BODY_FILE_OFF);
+    ngx_conf_merge_uint_value(conf->client_body_temp_access,
+                              prev->client_body_temp_access, 0);
     ngx_conf_merge_value(conf->client_body_in_single_buffer,
                               prev->client_body_in_single_buffer, 0);
     ngx_conf_merge_value(conf->internal, prev->internal, 0);
diff -r 8b68d50090e4 -r 67cc676dbfaf src/http/ngx_http_core_module.h
--- a/src/http/ngx_http_core_module.h	Wed Oct 03 14:08:51 2018 +0300
+++ b/src/http/ngx_http_core_module.h	Fri Oct 12 21:06:12 2018 +0200
@@ -375,6 +375,7 @@
     ngx_uint_t    if_modified_since;       /* if_modified_since */
     ngx_uint_t    max_ranges;              /* max_ranges */
     ngx_uint_t    client_body_in_file_only; /* client_body_in_file_only */
+    ngx_uint_t    client_body_temp_access; /* client_body_temp_access */
 
     ngx_flag_t    client_body_in_single_buffer;
                                            /* client_body_in_singe_buffer */
diff -r 8b68d50090e4 -r 67cc676dbfaf src/http/ngx_http_request_body.c
--- a/src/http/ngx_http_request_body.c	Wed Oct 03 14:08:51 2018 +0300
+++ b/src/http/ngx_http_request_body.c	Fri Oct 12 21:06:12 2018 +0200
@@ -450,6 +450,7 @@
         tf->file.fd = NGX_INVALID_FILE;
         tf->file.log = r->connection->log;
         tf->path = clcf->client_body_temp_path;
+        tf->access = clcf->client_body_temp_access;
         tf->pool = r->pool;
         tf->warn = "a client request body is buffered to a temporary file";
         tf->log_level = r->request_body_file_log_level;