<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
Thanks for the response Sergey A. Osokin.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
The problem is these temp locations are configurable parameters. So, from a spec file perspective it's hard to fetch these parameters and change the permissions.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
As ngnix is already doing the task of changing permission of top directory, is there any problem the same recursively?</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
Sorry, I'm using outlook so I don't know how to reply below your message, so it's a bit difficult. Apologies for that.<br>
</div>
<div class="elementToProof">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 14pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
--</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Shedi<br>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Sergey A. Osokin <osa@freebsd.org.ru><br>
<b>Sent:</b> 17 March 2023 02:46<br>
<b>To:</b> nginx@nginx.org <nginx@nginx.org><br>
<b>Cc:</b> Shreenidhi Shedi <sshedi@vmware.com><br>
<b>Subject:</b> Re: Changing ownership of proxy_temp and other temp directories</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">!! External Email<br>
<br>
Hi,<br>
<br>
On Thu, Mar 16, 2023 at 06:19:42PM +0000, Shreenidhi Shedi via nginx wrote:<br>
><br>
> I have hosted a nginx server instance and the temp directories are created under /etc/nginx/<br>
><br>
> $ ls -ld /etc/nginx/*_temp<br>
> drwx------ 2 nobody root 4096 Mar 16 15:21 /etc/nginx/client_body_temp<br>
[...]<br>
><br>
> And I updated to a newer version of nginx which runs in "nginx" user<br>
> context and after that these directory ownership is getting changed<br>
> to nginx:root but the issue is, it happens only on these top<br>
> directories and not directories within these temp directories.<br>
><br>
> I did strace on the same to confirm my theory.<br>
<br>
[strace is skipped]<br>
<br>
It seems like previously nginx' worker process was running under<br>
`nobody' user, so the directory structure has appropriate<br>
permissions. The configuration setting was changed to `nginx'<br>
user then, and when nginx main process started, it checked and<br>
updated directories permissions according to the new settings.<br>
<br>
> Now the issue is, why chown happens only on top directory and<br>
> not recursively on all files and directories inside them?<br>
<br>
Please take a look in the source code,<br>
<a href="https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhg.nginx.org%2Fnginx%2Ffile%2Ftip%2Fsrc%2Fcore%2Fngx_file.c%23l598&data=05%7C01%7Csshedi%40vmware.com%7Ccc1606f4494b48ed496308db2663c194%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C638145982140985501%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2BnlexAGf4iaOhxIl0GnCZOGUfufWlJyuefJOFP%2Bvb6I%3D&reserved=0">https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fhg.nginx.org%2Fnginx%2Ffile%2Ftip%2Fsrc%2Fcore%2Fngx_file.c%23l598&data=05%7C01%7Csshedi%40vmware.com%7Ccc1606f4494b48ed496308db2663c194%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C638145982140985501%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2BnlexAGf4iaOhxIl0GnCZOGUfufWlJyuefJOFP%2Bvb6I%3D&reserved=0</a><br>
<br>
> Is this a bug or is it fixed in latest version of nginx?<br>
<br>
I don't think there's a bug in that part of the code.<br>
As a workaround for the transition content to a new user, it's<br>
easy to run an one line script to update permissions of those<br>
directories.<br>
<br>
> I'm currently using nginx-1.22.0. Any help would be appreciated.<br>
<br>
I'd recommend to upgrade to the recent version in stable<br>
branch, 1.22.1.<br>
<br>
Thank you.<br>
<br>
--<br>
Sergey A. Osokin<br>
<br>
!! External Email: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender.<br>
</div>
</span></font></div>
</body>
</html>