nginx permission denied

[chrislaick]

Hello @sylus,

There were two commits (9cc2f08 and 66cc6b3) made in Dec last year that updated the nginx permissions and user:group for nginx directories.

After applying these changes, we're getting a permission denied error in our nginx pod with a CrashLoopBackoff status.

[emerg] 1#1: mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)
nginx: [emerg] mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)

Reverting these commits, back to the following seems to fix it for us:

RUN chgrp -R root /var/cache/nginx /var/run /var/log/nginx && \
    chmod -R 770 /var/cache/nginx /var/run /var/log/nginx

Any ideas on why we need to make this change and how to do it for existing nginx instances?

[sylus]

Hi @chrislaick oh no that is indeed a bug but I have since fixed it.

66cc6b3

What branch are you calling? It might be an older branch that I didn't backport the fix for but I should have.

Let me know your branch and I will backport for that branch and all ones later then that.

My apologies!

[chrislaick]

We're using the newest 11.1.x branch which includes the fix you've provided:

RUN chown -R nginx:www-data /var/cache/nginx /var/run /var/log/nginx && \
    chmod -R 755 /var/cache/nginx /var/run /var/log/nginx

However, we're getting those permission denied errors from the nginx pod. And just to clarify, reverting the fix back to the following fixes our permissions issue:

RUN chgrp -R root /var/cache/nginx /var/run /var/log/nginx && \
    chmod -R 770 /var/cache/nginx /var/run /var/log/nginx

On researching this, perhaps it has something to do with OpenShift using different user IDs:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/images/creating-images#use-uid_create-images

[chrislaick]

More specifically from the Red Hat link:

For an image to support running as an arbitrary user, directories and files that are written to by processes in the image must be owned by the root group and be read/writable by that group. Files to be executed must also have group execute permissions. Because the container user is always a member of the root group, the container user can read and write these files.

The previous set of permissions had correctly (for us, at least) set group as root or 0, and the group had rxw permissions (chmod 770), so OpenShift had no issues with mkdir.

We've cloned the docker-scaffold into our project, so we're able to modify this and revert back to the old permissions.. but I guess this isn't affecting your projects?

[smulvih2]

I've been using the 11.1.x branch locally for the WxT D11 upgrade over the past few months, but I haven't deployed it to OpenShift or Azure yet. Glad to hear you were able to work around the issue by cloning!

If this is causing issues specifically in OpenShift environments, should we consider reverting the permission changes back to use root? I'm not sure if there was a specific security or compatibility reason behind the original change, or if it was just aligning with general Linux conventions.

[sylus]

I'm thinking the real fix that will support both OpenShift and unprivileged nginx might be:

RUN uid=$(id -u) && gid=$(id -g) && \
    chown -R $uid:$gid /var/cache/nginx /var/run /var/log/nginx && \
    chmod -R 755 /var/cache/nginx /var/run /var/log/nginx

Does this adjustment still work for you @chrislaick ?

[chrislaick]

@sylus We can test this out today.

[chrislaick]

Getting the same issue after testing.