Add an option to proxy_cache_path that allows to set group permissions

[launchpad.net/~blubberdiblub]

We use rsync over ssh here to sync the cache contents of several equally configured proxies between each other.

We would like to use a dedicated user to do this synchronization (not www-data itself, but a user that is in the www-data group), but we cannot do that cleanly, as nginx creates all the files and directories without permission for the group and also removes the group write permission of the top level cache directory, even if I created it manually with that permission in beforehand:

# find . -ls | head -n 10
780623    4 drwxr-s---  18 www-data www-data     4096 Nov 19 10:17 .
780466    4 drwx--S--- 153 www-data www-data     4096 Dez 16 13:24 ./7
133728    4 drwx--S---   2 www-data www-data     4096 Dez 23 10:06 ./7/7a
136474    8 -rw-------   1 www-data www-data     5513 Nov 29 21:45 ./7/7a/03fc1fdb85e2af7774e7897295b517a7
132284    4 drwx--S---   2 www-data www-data     4096 Jan 16 08:34 ./7/5a
136405    8 -rw-------   1 www-data www-data     5963 Jan 16 08:34 ./7/5a/34a677247e238b33554204c70ba0d5a7
136409    8 -rw-------   1 www-data www-data     5626 Nov 25 05:30 ./7/5a/d5bae18f299754735ccb37b1588315a7
136407   16 -rw-------   1 www-data www-data    13921 Jan 11 15:08 ./7/5a/4b537fa48a610be5de370ed0224365a7
261924    4 drwx--S---   2 www-data www-data     4096 Jan 15 15:38 ./7/af
269642   76 -rw-------   1 www-data www-data    74393 Jan  7 18:08 ./7/af/3e88a64b4e851c1d4558aeb6becf0af7

There are several possible workarounds, neither of which we consider clean solutions: Using www-data directly to sync the cache forces us to give www-data a valid login shell to satisfy ssh (instead, we would like to disable login for www-data completely and just give the synchronization user a login shell). Also, we could probably set up some ACLs to enforce access for the synchronization user, but we would rather keep it clean and simple and just use vanilla group membership.

As nginx already has some way to specify permissions of created files and directories, just for a different feature (proxy_store_access), we think it shouldn't be too much effort to give us that possibility for the proxy cache as well.

Regards,
Niels Böhm

[Krzysztof Grzadziel]

I have already patch for that for nginx 1.7.9. It introduces new optional variables (file_access_rights and path_access_rights) to proxy_cache_path, fastcgi_cache_path and I believe to other *_cache_path variables.

Example usage in proxy_cache_path directive:
proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=NAME2:1m file_access_rights=0666 path_access_rights=0711;

[dmnc@…]

I would very much welcome this change if the patch is revivable.

My scenario is this:

• We use www-data user for nginx and php-fpm which can only write to very specific parts of the filesystem.
• We use a different user (in the www-data group) to create deployments which has access to change the entire webroot.
• We'd like to give the deployment user the ability to clear out the fastcgi_cache on deploy.

Being able to give group access to the contents of the cache would make this easy but right now we are having to do some ugliness to get the www-data user to do the clear rather than the deployer.

[Krzysztof Grządziel]

Hi, I revived patch. You can review it here ​http://mailman.nginx.org/pipermail/nginx-devel/2020-May/013143.html

Docs need to be updated and probably tests that covers new option should be added.

[Maxim Dounin]

Permissions are set on the cache directory and files in a such way since general assumption behind the cache management in nginx is that the cache directory is managed by a single nginx instance. While trying to sync cache directory to different servers might work in some cases, this isn't something we can recommend as a generic approach.