uWSGI Emperor Permission Denied unless root

I've tried using the flags on the binary itself (--uid www-data --gid www-data) and setting it in my config:

    uid = www-data
    gid = www-data

but the socket is always spawned with the account I'm working with, so i'm getting a permission denied error from nginx.

Anyone know why this is?

Additional question: Does anyone know where nginx and uwsgi have the user set? I have another server which has been working forever, and it does not have uid or gid set in any of the config files, yet everything is using www-data as it should.

ANSWER Apparently if you start the service from the terminal as I was trying to do, ie (user@server:~/$ uwsgi --uid www-data --gid www-data), it will always start and run with the user who called it which explains why I felt it wasn't obeying my uid and gid flags. When i run it as mentioned below, it does run with the correct user/group, www-data.

UPDATED

I'm starting uWSGI as you have said, "sudo service uwsgi start" which should be triggering this file (/etc/init/uwsgi.conf):

description "uWSGI"
start on runlevel [2345]
stop on runlevel [06]
respawn

env UWSGI=/home/ccadmin/.local/bin/uwsgi
env LOGTO=/var/log/uwsgi/emperor.log

exec $UWSGI --master --emperor /etc/uwsgi/vassals --die-on-term --uid www-data --gid www-data --logto $LOGTO

However with this configuration my emperor.log file says:

execvp(): Permission denied [core/emperor.c line 1481]
[emperor] binary path: /home/ccadmin/.local/bin/uwsgi
[emperor] is the uwsgi binary in your system PATH ?
TIME STAMP - [emperor] curse the uwsgi instance cc_uwsgi.ini (pid: ####)
TIME STAMP - [emperor] removed uwsgi instance cc_uwsgi.ini

If I change the --uid and --gid to root, then it all works fine. It must be some simple permission thing, but being new to linux, I'm finding it very hard to pinpoint.

Also strange that it is asking me about the uwsgi binary in my system path... is it supposed to be there? Because i have added /home/ccadmin/.local/bin to my system path in /etc/environment. Should it not be there? or should it go all the way to the binary? (ie, adding /home/ccadmin/.local/bin/uwsgi insetad of just to /bin)

回答1:

You should be starting the uwsgi as root, otherwise you're not allowed to switch to another user. Basic unix concept. Use the service uwsgi start command via sudo.

回答2:

Tyrant mode (secure multi-user hosting)