Bug 2277663 - please switch to using systemd-sysusers to create the nginx user
Summary: please switch to using systemd-sysusers to create the nginx user
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: nginx
Version: 40
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Felix Kaechele
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-04-29 01:59 UTC by Ajay Ramaswamy
Modified: 2025-02-15 02:36 UTC (History)
6 users (show)

Fixed In Version: nginx-1.26.3-1.fc42 nginx-1.26.3-1.fc40 nginx-1.26.3-1.fc41
Clone Of:
Environment:
Last Closed: 2025-02-06 20:46:44 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Ajay Ramaswamy 2024-04-29 01:59:38 UTC
see how it was done for apache

https://src.fedoraproject.org/rpms/httpd/c/54cb3fa126b5f8f8dbff7297c840646b19ec0567?branch=rawhide

this is to followup from an earlier attempt to get a fixed userid for nginx
https://bugzilla.redhat.com/show_bug.cgi?id=1853789

right now every container that I build with fedora-40 and nginx will come up with a different uid & gid for nginx with a jump to the new version please try to make this change

Reproducible: Always

Comment 1 Felix Kaechele 2024-04-29 02:28:24 UTC
Thanks for filing this bug.

Apache httpd historically has always had a static uid and gid (48) on Fedora.
Also, Fedora doesn't have a user and group that is common to all web servers on the system, the way Debian has this (www-data), which would probably solve this issue as well.
So nginx has always dynamically created its user and group and we never went through the process to have one statically allocated. See this for more details: https://docs.fedoraproject.org/en-US/packaging-guidelines/UsersAndGroups/#_soft_static_allocation

You can technically work around this by manually creating the nginx user and group in your Containerfile before installing the nginx package. That way you'd have full control over the uid/gid of the user.

Now, if you would like, I could start the process of having a static uid/gid assigned for nginx in Fedora. But I'm sensing that this will open a can of worms when it comes to all other web servers (e.g. Caddy) that are supported on Fedora that currently utilize dynamic user allocations.

But you are certainly right that we should move to the sysusers approach of allocating the user and group, now that the full systemd stack is no longer required. This used to be a blocker for us using this, since nginx is often used in minimal containers images which don't run systemd.

I'll put that on my list to test and verify for the next update.

Comment 2 Luboš Uhliarik 2025-02-04 00:39:44 UTC
Hello Felix,

I created a new PR [0] that enables NGINX to use systemd sysusers. In the sysusers file, I didn't set a static UID or GID. However, I think we can proceed with the sysusers transition first and then set the static UID and GID after merging this PR. What do you think?

[0] https://src.fedoraproject.org/rpms/nginx/pull-request/17

Comment 3 Fedora Update System 2025-02-06 20:42:48 UTC
FEDORA-2025-d5a48cff6d (nginx-1.26.3-1.fc42, nginx-mod-fancyindex-0.5.2-10.fc42, and 3 more) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-d5a48cff6d

Comment 4 Fedora Update System 2025-02-06 20:44:52 UTC
FEDORA-2025-66ebd291f8 (nginx-1.26.3-1.fc41, nginx-mod-fancyindex-0.5.2-10.fc41, and 3 more) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-66ebd291f8

Comment 5 Fedora Update System 2025-02-06 20:46:44 UTC
FEDORA-2025-d5a48cff6d (nginx-1.26.3-1.fc42, nginx-mod-fancyindex-0.5.2-10.fc42, and 3 more) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Fedora Update System 2025-02-06 20:47:05 UTC
FEDORA-2025-016ed44ddc (nginx-1.26.3-1.fc40, nginx-mod-fancyindex-0.5.2-8.fc40, and 3 more) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-016ed44ddc

Comment 7 Fedora Update System 2025-02-07 01:30:49 UTC
FEDORA-2025-66ebd291f8 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-66ebd291f8`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-66ebd291f8

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2025-02-07 02:44:01 UTC
FEDORA-2025-016ed44ddc has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-016ed44ddc`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-016ed44ddc

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2025-02-15 02:22:36 UTC
FEDORA-2025-016ed44ddc (nginx-1.26.3-1.fc40, nginx-mod-fancyindex-0.5.2-8.fc40, and 3 more) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Fedora Update System 2025-02-15 02:36:05 UTC
FEDORA-2025-66ebd291f8 (nginx-1.26.3-1.fc41, nginx-mod-fancyindex-0.5.2-10.fc41, and 3 more) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.