Hi all,

I’ve met with a rather unpleasant behaviour of nginx validation process (the one triggered by '-t’ command line option): it creates a pid file at the path from the configuration it validate, and leave this file alone.

It sounds rather inoffensively until you step in a RHEL7 with SELinux and wanted to use Ansible role for installing nginx there.

If you call ‘nginx -t -c /etc/nginx/nginx.conf’, then it creates a pid file with wrong SELinux context and the presence of this pid file breaks the next call to 'systemctl start nginx’. Which while failing to start nginx service, removes the pid file. So next calls to ‘systemctl start nginx’ will succeed.

Here is the proof log:

[root@SRV2-ELOG-VM58 ~]# ls -Z /run/nginx.pid
ls: cannot access /run/nginx.pid: No such file or directory
[root@SRV2-ELOG-VM58 ~]# systemctl start nginx
[root@SRV2-ELOG-VM58 ~]# ls -Z /run/nginx.pid
-rw-r--r--. root root system_u:object_r:httpd_var_run_t:s0 /run/nginx.pid
[root@SRV2-ELOG-VM58 ~]# systemctl stop nginx
[root@SRV2-ELOG-VM58 ~]# ls -Z /run/nginx.pid
ls: cannot access /run/nginx.pid: No such file or directory
[root@SRV2-ELOG-VM58 ~]# /usr/sbin/nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@SRV2-ELOG-VM58 ~]# ls -Z /run/nginx.pid
-rw-r--r--. root root unconfined_u:object_r:var_run_t:s0 /run/nginx.pid
[root@SRV2-ELOG-VM58 ~]# systemctl start nginx
Job for nginx.service failed. See 'systemctl status nginx.service' and 'journalctl -xn' for details.
[root@SRV2-ELOG-VM58 ~]# ls -Z /run/nginx.pid
ls: cannot access /run/nginx.pid: No such file or directory
[root@SRV2-ELOG-VM58 ~]# systemctl start nginx
[root@SRV2-ELOG-VM58 ~]# ls -Z /run/nginx.pid
-rw-r--r--. root root system_u:object_r:httpd_var_run_t:s0 /run/nginx.pid
[root@SRV2-ELOG-VM58 ~]#

Is there a way to ask nginx to remove the pid file it created during the validation process or not to create it at all?

Some additional info is here: https://github.com/geerlingguy/ansible-role-nginx/issues/41

With all the best,
Alex Vinokurov_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel