python-3.x - uWSGI 不会切换到自定义 uwsgi.ini 文件中定义的用户 uid=my_user

Question

我在运行 uwsgi 2.0.17.1 , nginx/1.12.2和 flask 1.0.2在 Centos 7 上运行自定义 API .除了进程归 uwsgi 所有之外，一切都很完美。用户，而我在自定义中明确定义了 .ini文件使用与 uwsgi 不同的用户
这是默认值 uwsgi ini 文件位于 /etc/uwsgi.ini

[uwsgi]
uid = uwsgi
gid = uwsgi
pidfile = /run/uwsgi/uwsgi.pid
emperor = /etc/uwsgi.d
stats = /run/uwsgi/stats.sock
chmod-socket = 660
emperor-tyrant = true
cap = setgid,setuid

这是我的自定义 .ini 文件的内容

[uwsgi]

chdir = /var/www/my_api/current
virtualenv = /var/www/my_api/current/my_api_virtualenv
module = wsgi
plugin = python36u
wsgi-file= wsgi.py
uid=svc.my_api
gid=svc.my_api
master = true
processes = 2
enable-threads = true
need-app=true
logto =/var/www/my_api/logs/my_api.log
socket =127.0.0.1:9090
vacuum = true
die-on-term = true

如果我运行命令 sudo systemctl status uwsgi

● uwsgi.service - uWSGI Emperor Service
   Loaded: loaded (/usr/lib/systemd/system/uwsgi.service; disabled; vendor preset: disabled)
   Active: active (running) since Fri 2018-10-19 11:47:01 CEST; 9s ago
 Main PID: 20038 (uwsgi)
   Status: "The Emperor is governing 1 vassals"
   CGroup: /system.slice/uwsgi.service
           ├─20038 /usr/sbin/uwsgi --ini /etc/uwsgi.ini
           ├─20039 /usr/sbin/uwsgi --ini /etc/uwsgi.ini
           ├─20040 /usr/sbin/uwsgi --ini my_api.ini
           ├─20043 /usr/sbin/uwsgi --ini my_api.ini
           └─20044 /usr/sbin/uwsgi --ini my_api.ini

Oct 19 11:47:01 my_server.local uwsgi[20038]: *** Operational MODE: no-workers ***
Oct 19 11:47:01 my_server.local uwsgi[20038]: spawned uWSGI master process (pid: 20038)
Oct 19 11:47:01 my_server.local uwsgi[20038]: [emperor-tyrant] dropping privileges to 997 995 for instance my_api.ini
Oct 19 11:47:01 my_server.local uwsgi[20038]: *** Stats server enabled on /run/uwsgi/stats.sock fd: 7 ***
Oct 19 11:47:01 my_server.local uwsgi[20038]: *** has_emperor mode detected (fd: 7) ***
Oct 19 11:47:01 my_server.local uwsgi[20038]: [uWSGI] getting INI configuration from my_api.ini
Oct 19 11:47:03 my_server.local uwsgi[20038]: Fri Oct 19 11:47:03 2018 - [emperor] vassal my_api.ini has been spawned
Oct 19 11:47:03 my_server.local uwsgi[20038]: Fri Oct 19 11:47:03 2018 - [emperor] vassal my_api.ini is ready to accept requests
Oct 19 11:47:03 my_server.local uwsgi[20038]: Fri Oct 19 11:47:03 2018 - [emperor] vassal my_api.ini is now loyal
Oct 19 11:47:03 my_server.local uwsgi[20038]: Fri Oct 19 11:47:03 2018 - [emperor] vassal my_api.ini is now loyal

你注意到它正常工作没有错误，但是当我检查 htop 时我看到以下内容:


所以尽管我指定的脸 uid和 gid在 my_app.ini 中，uwsgi 仍然运行进程为 uwsig .

当我改变这些变量时

uid = uwsgi
gid = uwsgi

在主 /etc/uwsgi.ini像是

uid=svc.my_api
gid=svc.my_api

它不起作用，我得到以下输出 sudo systemctl status uwsgi

● uwsgi.service - uWSGI Emperor Service
   Loaded: loaded (/usr/lib/systemd/system/uwsgi.service; disabled; vendor preset: disabled)
   Active: active (running) since Fri 2018-10-19 12:03:23 CEST; 309ms ago
 Main PID: 20118 (uwsgi)
   Status: "uWSGI is ready"
   CGroup: /system.slice/uwsgi.service
           └─20118 /usr/sbin/uwsgi --ini /etc/uwsgi.ini

Oct 19 12:03:23 my_server.local uwsgi[20118]: your memory page size is 4096 bytes
Oct 19 12:03:23 my_server.local uwsgi[20118]: detected max file descriptor number: 1024
Oct 19 12:03:23 my_server.local uwsgi[20118]: lock engine: pthread robust mutexes
Oct 19 12:03:23 my_server.local uwsgi[20118]: thunder lock: disabled (you can enable it with --thunder-lock)
Oct 19 12:03:23 my_server.local uwsgi[20118]: your mercy for graceful operations on workers is 60 seconds
Oct 19 12:03:23 my_server.local uwsgi[20118]: *** Operational MODE: no-workers ***
Oct 19 12:03:23 my_server.local uwsgi[20118]: spawned uWSGI master process (pid: 20118)
Oct 19 12:03:23 my_server.local uwsgi[20118]: error removing unix socket, unlink(): Permission denied [core/socket.c line 198]
Oct 19 12:03:23 my_server.local uwsgi[20118]: bind(): Address already in use [core/socket.c line 230]
Oct 19 12:03:23 my_server.local uwsgi[20118]: waiting for Emperor death...

所以我的问题是:有谁知道为什么 uwsgi 仍然在 uwsgi 用户下运行，我该如何使用 svc.my_app拥有uwsgi的进程？

更新 23/10/2018 基于@Kamil Niski 的评论 我试图运行 uWSGI作为根。
当我更换 uwsgi与 root在 /etc/uwsgi.ini

[uwsgi]
uid = root
gid = root
pidfile = /run/uwsgi/uwsgi.pid
emperor = /etc/uwsgi.d
stats = /run/uwsgi/stats.sock
chmod-socket = 660
emperor-tyrant = true
cap = setgid,setuid.

它不起作用，我收到以下错误:

-- Subject: Unit uwsgi.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit uwsgi.service has failed.
--
-- The result is failed.
Oct 23 14:13:08 my_server.local systemd[1]: Unit uwsgi.service entered failed state.
Oct 23 14:13:08 my_server.local systemd[1]: uwsgi.service failed.
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service holdoff time over, scheduling restart.
Oct 23 14:13:09 my_server.local systemd[1]: Starting uWSGI Emperor Service...
-- Subject: Unit uwsgi.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit uwsgi.service has begun starting up.
Oct 23 14:13:09 my_server.local uwsgi[32290]: [uWSGI] getting INI configuration from /etc/uwsgi.ini
Oct 23 14:13:09 my_server.local uwsgi[32290]: setting capability setgid [6]
Oct 23 14:13:09 my_server.local uwsgi[32290]: setting capability setuid [7]
Oct 23 14:13:09 my_server.local uwsgi[32290]: *** Starting uWSGI 2.0.17.1 (64bit) on [Tue Oct 23 14:13:09 2018] ***
Oct 23 14:13:09 my_server.local uwsgi[32290]: compiled with version: 4.8.5 20150623 (Red Hat 4.8.5-28) on 09 July 2018 03
Oct 23 14:13:09 my_server.local uwsgi[32290]: os: Linux-3.10.0-862.14.4.el7.x86_64 #1 SMP Wed Sep 26 15:12:11 UTC 2018
Oct 23 14:13:09 my_server.local uwsgi[32290]: nodename: my_server.local
Oct 23 14:13:09 my_server.local uwsgi[32290]: machine: x86_64
Oct 23 14:13:09 my_server.local uwsgi[32290]: clock source: unix
Oct 23 14:13:09 my_server.local uwsgi[32290]: pcre jit disabled
Oct 23 14:13:09 my_server.local uwsgi[32290]: detected number of CPU cores: 2
Oct 23 14:13:09 my_server.local uwsgi[32290]: current working directory: /
Oct 23 14:13:09 my_server.local uwsgi[32290]: writing pidfile to /run/uwsgi/uwsgi.pid
Oct 23 14:13:09 my_server.local uwsgi[32290]: detected binary path: /usr/sbin/uwsgi
Oct 23 14:13:09 my_server.local uwsgi[32290]: *** WARNING: you are running uWSGI as root !!! (use the --uid flag) ***
Oct 23 14:13:09 my_server.local uwsgi[32290]: your processes number limit is 15030
Oct 23 14:13:09 my_server.local uwsgi[32290]: your memory page size is 4096 bytes
Oct 23 14:13:09 my_server.local uwsgi[32290]: detected max file descriptor number: 1024
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service: main process exited, code=exited, status=1/FAILURE
Oct 23 14:13:09 my_server.local uwsgi[32290]: lock engine: pthread robust mutexes
Oct 23 14:13:09 my_server.local systemd[1]: Failed to start uWSGI Emperor Service.
-- Subject: Unit uwsgi.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit uwsgi.service has failed.
--
-- The result is failed.
Oct 23 14:13:09 my_server.local uwsgi[32290]: *** starting uWSGI Emperor ***
Oct 23 14:13:09 my_server.local systemd[1]: Unit uwsgi.service entered failed state.
Oct 23 14:13:09 my_server.local uwsgi[32290]: [emperor-tyrant] dropping privileges to 1004 1004 for instance my_api.ini
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service failed.
Oct 23 14:13:09 my_server.local uwsgi[32290]: thunder lock: disabled (you can enable it with --thunder-lock)
Oct 23 14:13:09 my_server.local uwsgi[32290]: cap_set_proc(): Operation not permitted [core/utils.c line 301]
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service holdoff time over, scheduling restart.
Oct 23 14:13:09 my_server.local systemd[1]: start request repeated too quickly for uwsgi.service
Oct 23 14:13:09 my_server.local systemd[1]: Failed to start uWSGI Emperor Service.
-- Subject: Unit uwsgi.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit uwsgi.service has failed.
--
-- The result is failed.
Oct 23 14:13:09 my_server.local systemd[1]: Unit uwsgi.service entered failed state.
Oct 23 14:13:09 my_server.local systemd[1]: uwsgi.service failed.

Answer 1

我设法在 svc.my_api 下运行 uWSGI更改以下目录的所有权后:
chown -R svc.my_api:svc.my_api /etc/uwsgi.d/chown svc.my_api:svc.my_api /etc/uwsgi.inichown -R svc.my_api:svc.my_api /run/uwsgi/
并通过编辑 /etc/uwsgi.ini

[uwsgi]
uid = svc.my_api
gid = svc.my_api
pidfile = /run/uwsgi/uwsgi.pid
emperor = /etc/uwsgi.d
stats = /run/uwsgi/stats.sock
chmod-socket = 660
emperor-tyrant = false
cap = setgid,setuid

设置皇霸为 false已经解决了问题!
为什么禁用霸王就可以解决问题？因为
皇帝暴君选项(如果它打开)，因为它根据相关 .ini 配置文件的所有者为每个进程设置 uid/gid。

资料来源:

https://chriswarrick.com/blog/2016/02/10/deploying-python-web-apps-with-nginx-and-uwsgi-emperor/

&

https://uwsgi-docs.readthedocs.io/en/latest/Emperor.html#tyrant-mode-secure-multi-user-hosting