Skip to content

test: fix nginx to run as non-root user#179

Merged
Bastian-Krause merged 1 commit into
rauc:masterfrom
tduf:tdu/fix-test-with-nginx
Jul 10, 2025
Merged

test: fix nginx to run as non-root user#179
Bastian-Krause merged 1 commit into
rauc:masterfrom
tduf:tdu/fix-test-with-nginx

Conversation

@tduf

@tduf tduf commented Jun 28, 2024

Copy link
Copy Markdown
Contributor

Logs

$ ./test/wait-for-hawkbit-online && dbus-run-session -- pytest -v -o log_cli=true test/test_download.py
[...]
test/test_download.py::test_download_too_slow
-------------------------------------------------------- live log call --------------------------------------------------------
INFO nginx running: nginx -c /tmp/pytest-of-thibaud/pytest-8/nginx0/nginx.conf -p .
INFO nginx nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
INFO nginx 2024/06/28 15:41:56 [emerg] 1450257#1450257: mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
SKIPPED (nginx failed, use -s to see logs)                                                                              [ 42%]
test/test_download.py::test_download_partials_without_resume
------------------------------------------------------- live log setup --------------------------------------------------------
INFO nginx running: nginx -c /tmp/pytest-of-thibaud/pytest-8/nginx1/nginx.conf -p .
INFO nginx nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
INFO nginx 2024/06/28 15:41:56 [emerg] 1450258#1450258: mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
SKIPPED (nginx failed, use -s to see logs)                                                                              [ 57%]
test/test_download.py::test_download_partials_with_resume SKIPPED (nginx failed, use -s to see logs)                    [ 71%]
test/test_download.py::test_download_slow_with_resume
-------------------------------------------------------- live log call --------------------------------------------------------
INFO nginx running: nginx -c /tmp/pytest-of-thibaud/pytest-8/nginx2/nginx.conf -p .
INFO nginx nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
INFO nginx 2024/06/28 15:41:56 [emerg] 1450259#1450259: mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
SKIPPED (nginx failed, use -s to see logs)

Run on Fedora 40 with following rpm packages installed:

meson
ninja-build
libcurl-devel
json-glib-devel
python3-sphinx

# Needed by pip install -r test-requirements.txt
pkg-config
cairo
cairo-devel
cairo-gobject-devel
gobject-introspection
gobject-introspection-devel

nginx
nginx-all-modules

@tduf

tduf commented Jun 28, 2024

Copy link
Copy Markdown
Contributor Author

With this fix, there is still issues with test/test_download.py::test_download_partials_without_resume (download succeed) and test_download_partials_with_resume (download succeed without resume).

@tduf
tduf force-pushed the tdu/fix-test-with-nginx branch from d3c867d to 23a6f0d Compare June 28, 2024 14:46
@Bastian-Krause

Bastian-Krause commented Dec 18, 2024

Copy link
Copy Markdown
Member

It's not clear to me what fails at your end. I can run the tests successfully as an unprivileged user with Debian trixie. The nginx errors are somewhat expected for unprivileged users, but should not be fatal:

# non-fatal alert for /var/log/nginx/error.log will still be shown
# https://trac.nginx.org/nginx/ticket/147

Can you provide logs of a pytest run with -s?

@tduf

tduf commented Dec 19, 2024

Copy link
Copy Markdown
Contributor Author

Here is a run on master branch with Fedora 41 (nginx 1.26.2) with pytest -s:
failure_with_-s_on_master.log

@Bastian-Krause
Bastian-Krause marked this pull request as draft March 12, 2025 14:18
@Bastian-Krause
Bastian-Krause force-pushed the tdu/fix-test-with-nginx branch from 23a6f0d to e4d3004 Compare March 12, 2025 14:19
@Bastian-Krause

Copy link
Copy Markdown
Member

Okay, since it's officially documented, we should apply the config directives. Rebased on top of #188 and marked as draft for now. Once the depending PRs are merged, we can mark this as "ready for review".

@Bastian-Krause Bastian-Krause changed the title Fix nginx to run test test_downloadp.y local as non-root user test: fix nginx to run as non-root user Mar 12, 2025
@Bastian-Krause Bastian-Krause self-assigned this Mar 12, 2025
@Bastian-Krause
Bastian-Krause force-pushed the tdu/fix-test-with-nginx branch 3 times, most recently from f84e82e to b18ac03 Compare March 13, 2025 10:32
@Bastian-Krause
Bastian-Krause force-pushed the tdu/fix-test-with-nginx branch 2 times, most recently from ea506c5 to 1e28022 Compare July 10, 2025 10:22
@Bastian-Krause
Bastian-Krause marked this pull request as ready for review July 10, 2025 10:22
Bastian-Krause
Bastian-Krause previously approved these changes Jul 10, 2025
Under some unknown circumstances, the current nginx config run as
non-root still leads to fatal errors:

    $ ./test/wait-for-hawkbit-online && dbus-run-session -- pytest -v -o log_cli=true test/test_download.py
    [...]
    test/test_download.py::test_download_too_slow
    -------------------------------------------------------- live log call --------------------------------------------------------
    INFO nginx running: nginx -c /tmp/pytest-of-thibaud/pytest-8/nginx0/nginx.conf -p .
    INFO nginx nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
    INFO nginx 2024/06/28 15:41:56 [emerg] 1450257#1450257: mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
    SKIPPED (nginx failed, use -s to see logs)                                                                              [ 42%]
    test/test_download.py::test_download_partials_without_resume
    ------------------------------------------------------- live log setup --------------------------------------------------------
    INFO nginx running: nginx -c /tmp/pytest-of-thibaud/pytest-8/nginx1/nginx.conf -p .
    INFO nginx nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
    INFO nginx 2024/06/28 15:41:56 [emerg] 1450258#1450258: mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
    SKIPPED (nginx failed, use -s to see logs)                                                                              [ 57%]
    test/test_download.py::test_download_partials_with_resume SKIPPED (nginx failed, use -s to see logs)                    [ 71%]
    test/test_download.py::test_download_slow_with_resume
    -------------------------------------------------------- live log call --------------------------------------------------------
    INFO nginx running: nginx -c /tmp/pytest-of-thibaud/pytest-8/nginx2/nginx.conf -p .
    INFO nginx nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
    INFO nginx 2024/06/28 15:41:56 [emerg] 1450259#1450259: mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)
    SKIPPED (nginx failed, use -s to see logs)

The section "Running nginx as a non-root user" of the official nginx
docker image [1] gives a hint what options must be set to not run into
errors. Apply the config directives appropriate for our use case.

[1] https://hub.docker.com/_/nginx

Signed-off-by: Thibaud Dufour <thibaudd@rtone.fr>
[bst: dropped unused options fastcgi_temp_path, uwsgi_temp_path, scgi_temp_path, rebased]
Signed-off-by: Bastian Krause <bst@pengutronix.de>
@Bastian-Krause
Bastian-Krause merged commit f0928cd into rauc:master Jul 10, 2025
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants