# Why "user" directive is not effective for master process?

**URL:** <https://www.ruby-forum.com/t/why-user-directive-is-not-effective-for-master-process/226172>\
**Category:** NGINX\
**Created:** [December 16, 2010, 3:14am UTC](https://www.ruby-forum.com/t/why-user-directive-is-not-effective-for-master-process/226172 "2010-12-16T03:14:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [December 16, 2010, 3:14am UTC](https://www.ruby-forum.com/t/why-user-directive-is-not-effective-for-master-process/226172/1 "2010-12-16T03:14:12Z")

</div>

When I set “user user1;” in config and use sudo to start nginx, all  
worker processes are owned by “user1”, only master process are owned by  
“root”. With these, I can’t create a Linux account with proper  
permission setting for only nginx.

Posted at Nginx Forum:

> **[Why "user" directive is not effective for master process?](https://forum.nginx.org/read.php?2,159000,159000#msg-159000)**
>
> When I set "user user1;" in config and use sudo to start nginx, all worker processes are owned by "user1", only master process are owned by "root". With these, I can't create a Linux account with proper permission...

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [December 16, 2010, 4:28am UTC](https://www.ruby-forum.com/t/why-user-directive-is-not-effective-for-master-process/226172/2 "2010-12-16T04:28:05Z")

</div>

Hello!

On Wed, Dec 15, 2010 at 09:12:53PM -0500, speedfirst wrote:

> When I set “user user1;” in config and use sudo to start nginx, all  
> worker processes are owned by “user1”, only master process are owned by  
> “root”. With these, I can’t create a Linux account with proper  
> permission setting for only nginx.

Master process needs root to (re)open listening sockets on  
priveleged ports, upgrade binary and so on.

If you want master to be non-root you are free to start it as  
normal user. Though you may need some OS tuning to allow it to bind  
to privileged ports in this case (not sure if Linux will be able  
to do this securely).

Maxim D.

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [December 16, 2010, 6:34am UTC](https://www.ruby-forum.com/t/why-user-directive-is-not-effective-for-master-process/226172/3 "2010-12-16T06:34:23Z")

</div>

On Thu, 2010-12-16 at 06:26 +0300, Maxim D. wrote:

> If you want master to be non-root you are free to start it as  
> normal user. Though you may need some OS tuning to allow it to bind  
> to privileged ports in this case (not sure if Linux will be able  
> to do this securely).

setcap ‘cap\_net\_bind\_service=+ep’ /usr/bin/nginx

> **[capabilities(7) - Linux manual page](https://man7.org/linux/man-pages/man7/capabilities.7.html)**

Only works on kernels \>= 2.6.24

Cliff

–  
Cliff W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)