uWSGI不会在自定义uwsgi.ini文件中切换到已定义的用户uid = my_user
我正在运行uwsgi 2.0.17.1，nginx/1.12.2和flask 1.0.2在Centos 7上运行自定义API。一切工作正常，除了进程由uwsgi用户拥有，而我在自定义.ini文件中明确定义为使用不同于uwsgi的用户时
这是uwsgi
/etc/uwsgi.ini ini文件
[uwsgi]
uid = uwsgi
gid = uwsgi
pidfile = /run/uwsgi/uwsgi.pid
emperor = /etc/uwsgi.d
stats = /run/uwsgi/stats.sock
chmod-socket = 660
emperor-tyrant = true
cap = setgid,setuid
这是我的自定义.ini文件的内容
[uwsgi]
chdir = /var/www/my_api/current
virtualenv = /var/www/my_api/current/my_api_virtualenv
module = wsgi
plugin = python36u
wsgi-file= wsgi.py
uid=svc.my_api
gid=svc.my_api
master = true
processes = 2
enable-threads = true
need-app=true
logto =/var/www/my_api/logs/my_api.log
socket =127.0.0.1:9090
vacuum = true
die-on-term = true
如果我运行命令sudo systemctl status uwsgi
● uwsgi.service - uWSGI Emperor Service
Loaded: loaded (/usr/lib/systemd/system/uwsgi.service; disabled; vendor preset: disabled)
Active: active (running) since Fri 2018-10-19 11:47:01 CEST; 9s ago
Main PID: 20038 (uwsgi)
Status: "The Emperor is governing 1 vassals"
CGroup: /system.slice/uwsgi.service
├─20038 /usr/sbin/uwsgi --ini /etc/uwsgi.ini
├─20039 /usr/sbin/uwsgi --ini /etc/uwsgi.ini
├─20040 /usr/sbin/uwsgi --ini my_api.ini
├─20043 /usr/sbin/uwsgi --ini my_api.ini
└─20044 /usr/sbin/uwsgi --ini my_api.ini
Oct 19 11:47:01 my_server.local uwsgi[20038]: *** Operational MODE: no-workers ***
Oct 19 11:47:01 my_server.local uwsgi[20038]: spawned uWSGI master process (pid: 20038)
Oct 19 11:47:01 my_server.local uwsgi[20038]: [emperor-tyrant] dropping privileges to 997 995 for instance my_api.ini
Oct 19 11:47:01 my_server.local uwsgi[20038]: *** Stats server enabled on /run/uwsgi/stats.sock fd: 7 ***
Oct 19 11:47:01 my_server.local uwsgi[20038]: *** has_emperor mode detected (fd: 7) ***
Oct 19 11:47:01 my_server.local uwsgi[20038]: [uWSGI] getting INI configuration from my_api.ini
Oct 19 11:47:03 my_server.local uwsgi[20038]: Fri Oct 19 11:47:03 2018 - [emperor] vassal my_api.ini has been spawned
Oct 19 11:47:03 my_server.local uwsgi[20038]: Fri Oct 19 11:47:03 2018 - [emperor] vassal my_api.ini is ready to accept requests
Oct 19 11:47:03 my_server.local uwsgi[20038]: Fri Oct 19 11:47:03 2018 - [emperor] vassal my_api.ini is now loyal
Oct 19 11:47:03 my_server.local uwsgi[20038]: Fri Oct 19 11:47:03 2018 - [emperor] vassal my_api.ini is now loyal
您注意到它正常运行，没有错误，但是当我检查htop时，我看到以下内容：
因此，尽管我在my_app.ini中指定了uid和gid，但是uwsgi仍以uwsig的身份运行进程。
当我更改这些变量时
uid = uwsgi gid = uwsgi
在主/etc/uwsgi.ini中就像
uid=svc.my_api
gid=svc.my_api
它不起作用，我得到以下sudo systemctl status uwsgi的输出
● uwsgi.service - uWSGI Emperor Service
Loaded: loaded (/usr/lib/systemd/system/uwsgi.service; disabled; vendor preset: disabled)
Active: active (running) since Fri 2018-10-19 12:03:23 CEST; 309ms ago
Main PID: 20118 (uwsgi)
Status: "uWSGI is ready"
CGroup: /system.slice/uwsgi.service
└─20118 /usr/sbin/uwsgi --ini /etc/uwsgi.ini
Oct 19 12:03:23 my_server.local uwsgi[20118]: your memory page size is 4096 bytes
Oct 19 12:03:23 my_server.local uwsgi[20118]: detected max file descriptor number: 1024
Oct 19 12:03:23 my_server.local uwsgi[20118]: lock engine: pthread robust mutexes
Oct 19 12:03:23 my_server.local uwsgi[20118]: thunder lock: disabled (you can enable it with --thunder-lock)
Oct 19 12:03:23 my_server.local uwsgi[20118]: your mercy for graceful operations on workers is 60 seconds
Oct 19 12:03:23 my_server.local uwsgi[20118]: *** Operational MODE: no-workers ***
Oct 19 12:03:23 my_server.local uwsgi[20118]: spawned uWSGI master process (pid: 20118)
Oct 19 12:03:23 my_server.local uwsgi[20118]: error removing unix socket, unlink(): Permission denied [core/socket.c line 198]
Oct 19 12:03:23 my_server.local uwsgi[20118]: bind(): Address already in use [core/socket.c line 230]
Oct 19 12:03:23 my_server.local uwsgi[20118]: waiting for Emperor death...
所以我的问题是：有人知道uwsgi为什么仍在uwsgi用户下运行吗？如何使用svc.my_app来拥有uwsgi的进程？
更新23/10/2018基于@Kamil Niski的评论，我尝试以root用户身份运行uWSGI。
当我在uwsgi中用root替换/etc/uwsgi.ini
[uwsgi]
uid = root
gid = root
pidfile = /run/uwsgi/uwsgi.pid
emperor = /etc/uwsgi.d
stats = /run/uwsgi/stats.sock
chmod-socket = 660
emperor-tyrant = true
cap = setgid,setuid.
它不起作用，出现以下错误：
-- Subject: Unit uwsgi.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit uwsgi.service has failed.
--
-- The result is failed.
Oct 23 14:13:08 my_server.local systemd[1]: Unit uwsgi.service entered failed state.
Oct 23 14:13:08 my_server.local systemd[1]: uwsgi.service failed.
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service holdoff time over, scheduling restart.
Oct 23 14:13:09 my_server.local systemd[1]: Starting uWSGI Emperor Service...
-- Subject: Unit uwsgi.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit uwsgi.service has begun starting up.
Oct 23 14:13:09 my_server.local uwsgi[32290]: [uWSGI] getting INI configuration from /etc/uwsgi.ini
Oct 23 14:13:09 my_server.local uwsgi[32290]: setting capability setgid [6]
Oct 23 14:13:09 my_server.local uwsgi[32290]: setting capability setuid [7]
Oct 23 14:13:09 my_server.local uwsgi[32290]: *** Starting uWSGI 2.0.17.1 (64bit) on [Tue Oct 23 14:13:09 2018] ***
Oct 23 14:13:09 my_server.local uwsgi[32290]: compiled with version: 4.8.5 20150623 (Red Hat 4.8.5-28) on 09 July 2018 03
Oct 23 14:13:09 my_server.local uwsgi[32290]: os: Linux-3.10.0-862.14.4.el7.x86_64 #1 SMP Wed Sep 26 15:12:11 UTC 2018
Oct 23 14:13:09 my_server.local uwsgi[32290]: nodename: my_server.local
Oct 23 14:13:09 my_server.local uwsgi[32290]: machine: x86_64
Oct 23 14:13:09 my_server.local uwsgi[32290]: clock source: unix
Oct 23 14:13:09 my_server.local uwsgi[32290]: pcre jit disabled
Oct 23 14:13:09 my_server.local uwsgi[32290]: detected number of CPU cores: 2
Oct 23 14:13:09 my_server.local uwsgi[32290]: current working directory: /
Oct 23 14:13:09 my_server.local uwsgi[32290]: writing pidfile to /run/uwsgi/uwsgi.pid
Oct 23 14:13:09 my_server.local uwsgi[32290]: detected binary path: /usr/sbin/uwsgi
Oct 23 14:13:09 my_server.local uwsgi[32290]: *** WARNING: you are running uWSGI as root !!! (use the --uid flag) ***
Oct 23 14:13:09 my_server.local uwsgi[32290]: your processes number limit is 15030
Oct 23 14:13:09 my_server.local uwsgi[32290]: your memory page size is 4096 bytes
Oct 23 14:13:09 my_server.local uwsgi[32290]: detected max file descriptor number: 1024
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service: main process exited, code=exited, status=1/FAILURE
Oct 23 14:13:09 my_server.local uwsgi[32290]: lock engine: pthread robust mutexes
Oct 23 14:13:09 my_server.local systemd[1]: Failed to start uWSGI Emperor Service.
-- Subject: Unit uwsgi.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit uwsgi.service has failed.
--
-- The result is failed.
Oct 23 14:13:09 my_server.local uwsgi[32290]: *** starting uWSGI Emperor ***
Oct 23 14:13:09 my_server.local systemd[1]: Unit uwsgi.service entered failed state.
Oct 23 14:13:09 my_server.local uwsgi[32290]: [emperor-tyrant] dropping privileges to 1004 1004 for instance my_api.ini
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service failed.
Oct 23 14:13:09 my_server.local uwsgi[32290]: thunder lock: disabled (you can enable it with --thunder-lock)
Oct 23 14:13:09 my_server.local uwsgi[32290]: cap_set_proc(): Operation not permitted [core/utils.c line 301]
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service holdoff time over, scheduling restart.
Oct 23 14:13:09 my_server.local systemd[1]: start request repeated too quickly for uwsgi.service
Oct 23 14:13:09 my_server.local systemd[1]: Failed to start uWSGI Emperor Service.
-- Subject: Unit uwsgi.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit uwsgi.service has failed.
--
-- The result is failed.
Oct 23 14:13:09 my_server.local systemd[1]: Unit uwsgi.service entered failed state.
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service failed.
2 个答案:
答案 0 :(得分：1)
uwsgi文档为您提供了可能出问题的提示。
皇帝通常以root身份运行，在每个皇帝中设置UID和GID 实例的配置。然后，附庸实例会在之前放弃特权 服务请求。在这种模式下，如果您的用户可以访问自己的 uWSGI配置文件，您无法信任它们来设置正确的uid 和女佣。 您可以以非特权用户身份运行皇帝（使用uid 和gid），但所有附庸将在同一个用户下运行，例如 非特权用户无法将自己提升为其他人 用户。
这意味着您应该以root身份运行皇帝，然后应按预期方式放弃vassals特权。
答案 1 :(得分：0)
更改以下目录的所有权后，我设法在DefaultRangeItem下运行uWSGI：
svc.my_api
chown -R svc.my_api:svc.my_api /etc/uwsgi.d/
chown svc.my_api:svc.my_api /etc/uwsgi.ini
并通过编辑chown -R svc.my_api:svc.my_api /run/uwsgi/
/etc/uwsgi.ini将帝君设置为[uwsgi]
uid = svc.my_api
gid = svc.my_api
pidfile = /run/uwsgi/uwsgi.pid
emperor = /etc/uwsgi.d
stats = /run/uwsgi/stats.sock
chmod-socket = 660
emperor-tyrant = false
cap = setgid,setuid
已解决了该问题！
为什么禁用皇帝暴君可以解决问题？因为
如果启用了Emperor-tyrant选项，则它会根据相关.ini配置文件的所有者为每个进程设置uid / gid。
来源：
https://chriswarrick.com/blog/2016/02/10/deploying-python-web-apps-with-nginx-and-uwsgi-emperor/
＆
https://uwsgi-docs.readthedocs.io/en/latest/Emperor.html#tyrant-mode-secure-multi-user-hosting
相关问题
- 在uwsgi配置文件中使用for-readline并不起作用
- uWSGI进程不会继承与其uid所属的组关联的权限
- 解析uwsgi.ini内部路由中的主机名
- 配置uwsgi.ini文件，以便DJango项目在Docker容器中工作
- 在这种情况下，如何设置uwsgi.ini？
- 无法运行`uwsgi --ini uwsgi.ini`，并且没有加载app的日志。进入完全动态模式
- 如何使logrotate服从logrotate.d / uwsgi而不是uwsgi.ini？ （Centos 6）
- uWSGI不会在自定义uwsgi.ini文件中切换到已定义的用户uid = my_user
- Django uwsgi.ini文件
- 使用Django和Pipenv的uwsgi.ini文件的正确设置
最新问题
- 我写了这段代码，但我无法理解我的错误
- 我无法从一个代码实例的列表中删除 None 值，但我可以在另一个实例中。为什么它适用于一个细分市场而不适用于另一个细分市场？
- 是否有可能使 loadstring 不可能等于打印？卢阿
- java中的random.expovariate()
- Appscript 通过会议在 Google 日历中发送电子邮件和创建活动
- 为什么我的 Onclick 箭头功能在 React 中不起作用？
- 在此代码中是否有使用“this”的替代方法？
- 在 SQL Server 和 PostgreSQL 上查询，我如何从第一个表获得第二个表的可视化
- 每千个数字得到
- 更新了城市边界 KML 文件的来源？