From 922d60f30560d89525a187f61ba10fa37aeaeae4 Mon Sep 17 00:00:00 2001 From: Zurab Kvachadze Date: Tue, 16 Sep 2025 21:57:13 +0200 Subject: [PATCH] www-server/nginx: revbump tmpfiles: /var/tmp/nginx -> /var/cache/nginx In contrast to /var/tmp, /var/cache is only writable by root, so it should be more foolproof against possible exploitation. As previously, the cache directory's permissions is adjusted every time this tmpfiles.d config is read. This new config deviates from the previous one's behaviour by only cleaning /var/cache/nginx boot to not prune the temporary files of the running NGINX instance (e.g. on upgrade), if there is one running. Bug: https://bugs.gentoo.org/962961 Signed-off-by: Zurab Kvachadze Part-of: https://github.com/gentoo/gentoo/pull/43823 Signed-off-by: Sam James --- www-servers/nginx/files/nginx-r1.tmpfiles | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 www-servers/nginx/files/nginx-r1.tmpfiles diff --git a/www-servers/nginx/files/nginx-r1.tmpfiles b/www-servers/nginx/files/nginx-r1.tmpfiles new file mode 100644 index 0000000000000..eda6d705bbb23 --- /dev/null +++ b/www-servers/nginx/files/nginx-r1.tmpfiles @@ -0,0 +1,4 @@ +d /var/cache/nginx 0755 root root + +# Clean up the cache only on boot to not break running NGINX +e! /var/cache/nginx/ - - - 0