suzanne.soy/nixpkgs
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

nixos/nginx: do not run anything as root

Browse Source
This commit is contained in:
Izorkin 2019-05-30 14:11:56 +03:00
parent ed5c0443c1
commit 2a413da57e
2 changed files with 31 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
nixos/doc/manual/release-notes/rl-2003.xml
View File

@ -249,6 +249,18 @@
<listitem> <listitem>
<para>SD images are now compressed by default using <literal>bzip2</literal>.</para> <para>SD images are now compressed by default using <literal>bzip2</literal>.</para>
</listitem> </listitem>
<listitem>
<para>
The nginx web server previously started its master process as root
privileged, then ran worker processes as a less privileged identity user.
This was changed to start all of nginx as a less privileged user (defined by
<literal>services.nginx.user</literal> and
<literal>services.nginx.group</literal>). As a consequence, all files that
are needed for nginx to run (included configuration fragments, SSL
certificates and keys, etc.) must now be readable by this less privileged
user/group.
</para>
</listitem>
<listitem> <listitem>
<para> <para>
OpenSSH has been upgraded from 7.9 to 8.1, improving security and adding features OpenSSH has been upgraded from 7.9 to 8.1, improving security and adding features

31
nixos/modules/services/web-servers/nginx/default.nix
View File

@ -47,7 +47,7 @@ let
'')); ''));
configFile = pkgs.writers.writeNginxConfig "nginx.conf" '' configFile = pkgs.writers.writeNginxConfig "nginx.conf" ''
user ${cfg.user} ${cfg.group}; pid /run/nginx/nginx.pid;
error_log ${cfg.logError}; error_log ${cfg.logError};
daemon off; daemon off;
@ -366,12 +366,7 @@ in
preStart = mkOption { preStart = mkOption {
type = types.lines; type = types.lines;
default = '' default = "";
test -d ${cfg.stateDir}/logs || mkdir -m 750 -p ${cfg.stateDir}/logs
test `stat -c %a ${cfg.stateDir}` = "750" || chmod 750 ${cfg.stateDir}
test `stat -c %a ${cfg.stateDir}/logs` = "750" || chmod 750 ${cfg.stateDir}/logs
chown -R ${cfg.user}:${cfg.group} ${cfg.stateDir}
'';
description = " description = "
Shell commands executed before the service's nginx is started. Shell commands executed before the service's nginx is started.
"; ";
@ -673,23 +668,35 @@ in
} }
]; ];
systemd.tmpfiles.rules = [
"d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group} - -"
"d '${cfg.stateDir}/logs' 0750 ${cfg.user} ${cfg.group} - -"
];
systemd.services.nginx = { systemd.services.nginx = {
description = "Nginx Web Server"; description = "Nginx Web Server";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
wants = concatLists (map (vhostConfig: ["acme-${vhostConfig.serverName}.service" "acme-selfsigned-${vhostConfig.serverName}.service"]) acmeEnabledVhosts); wants = concatLists (map (vhostConfig: ["acme-${vhostConfig.serverName}.service" "acme-selfsigned-${vhostConfig.serverName}.service"]) acmeEnabledVhosts);
after = [ "network.target" ] ++ map (vhostConfig: "acme-selfsigned-${vhostConfig.serverName}.service") acmeEnabledVhosts; after = [ "network.target" ] ++ map (vhostConfig: "acme-selfsigned-${vhostConfig.serverName}.service") acmeEnabledVhosts;
stopIfChanged = false; stopIfChanged = false;
preStart = preStart = ''
''
${cfg.preStart} ${cfg.preStart}
${cfg.package}/bin/nginx -c ${configPath} -p ${cfg.stateDir} -t ${cfg.package}/bin/nginx -c '${configPath}' -p '${cfg.stateDir}' -t
''; '';
serviceConfig = { serviceConfig = {
ExecStart = "${cfg.package}/bin/nginx -c ${configPath} -p ${cfg.stateDir}"; ExecStart = "${cfg.package}/bin/nginx -c '${configPath}' -p '${cfg.stateDir}'";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Restart = "always"; Restart = "always";
RestartSec = "10s"; RestartSec = "10s";
StartLimitInterval = "1min"; StartLimitInterval = "1min";
# User and group
User = cfg.user;
Group = cfg.group;
# Runtime directory and mode
RuntimeDirectory = "nginx";
RuntimeDirectoryMode = "0750";
# Capabilities
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
}; };
}; };