讓nginx在CentOS下以chroot的方式運行

實驗環境爲64位的CentOS6.4，nginx使用官方最新穩定版的，

下載源碼包

# wget http://nginx.org/download/nginx-1.6.2.tar.gz

[root@2core local]# tar zxvf nginx-1.6.2.tar.gz

隱藏nginx的真實版本，修改nginx顯示版本及名稱, 

[root@2core nginx-1.6.2]# vi /usr/local/nginx-1.6.2/src/core/nginx.h

#define NGINX_VERSION "1.6.2" /*版本號,本身改*/ #define NGINX_VER "Your string here" /*顯示版本時直接顯示此字符串*/

增長用戶
#groupadd nginx

#useradd -g nginx nginx

[root@2core nginx-1.6.2]# cd /usr/local/nginx-1.6.2

[root@2core nginx-1.6.2]# ./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_gzip_static_module --http-log-path=/var/log/nginx/access.log

#make

#make install

安裝完成，測試是否能正常啓動

# /usr/local/nginx/sbin/nginx

[root@2core nginx-1.6.2]# ps auxf|grep nginx   //檢查nginx是否正常啓，也能夠http://ip 訪問確認，注意iptables也是打開了相關的端口
root 7740 0.0 0.0 103240 852 pts/0 S+ 16:28 0:00 \_ grep nginx 
root 7649 0.0 0.0 20212 604 ? Ss 16:26 0:00 nginx: master process /usr/local/nginx/sbin/nginx 
nginx 7650 0.0 0.1 20636 1476 ? S 16:26 0:00 \_ nginx: worker process

一切正常，下面開始實施chroot,

一、創建一個chroot運行牢籠(Jail)根目錄，好比/nginx

#D=/nginx

#mkdir -p $D

二、創建一個獨立的運行環境，nginx將被限制在這環境下運行

mkdir -p $D/etc

mkdir -p $D/dev

mkdir -p $D/var

mkdir -p $D/usr

mkdir -p $D/usr/local/nginx

mkdir -p $D/tmp

chmod 1777 $D/tmp

mkdir -p $D/var/tmp

chmod 1777 $D/var/tmp

mkdir -p $D/lib64

三、還有些特殊設備須要建立，不然可能出錯

# ls -l /dev/{null,random,urandom}

[root@2core nginx-1.6.2]# ls -l /dev/{null,random,urandom} 
crw-rw-rw-. 1 root root 1, 3 9月 13 2013 /dev/null 
crw-rw-rw-. 1 root root 1, 8 9月 13 2013 /dev/random 
crw-rw-rw-. 1 root root 1, 9 9月 13 2013 /dev/urandom

#/bin/mknod -m 0666 $D/dev/null c 1 3

#/bin/mknod -m 0666 $D/dev/random c 1 8

#/bin/mknod -m 0444 $D/dev/urandom c 1 9

四、將/urs/local/nginx目錄裏全部的文件複製到$D/usr/local/nginx目錄去

# /bin/cp -farv /usr/local/nginx/* $D/usr/local/nginx

五、由於要啓動 $D/usr/local/nginx/sbin/nginx,涉及一些庫， 相應地，複製相關的庫到Jail對應目錄去，使用下面的命令查看關聯的庫

# ldd /usr/local/nginx/sbin/nginx  
linux-vdso.so.1 => (0x00007fff225ff000)   //這個不用複製
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fb450acf000)  
libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fb450898000)  
libpcre.so.0 => /lib64/libpcre.so.0 (0x00007fb45066b000)  
libz.so.1 => /lib64/libz.so.1 (0x00007fb450455000)  
libc.so.6 => /lib64/libc.so.6 (0x00007fb4500c2000)  
/lib64/ld-linux-x86-64.so.2 (0x00007fb450cf5000)  
libfreebl3.so => /lib64/libfreebl3.so (0x00007fb44fe5f000)  
libdl.so.2 => /lib64/libdl.so.2 (0x00007fb44fc5b000)

六、把上面關聯的複製到相應目錄裏去

[ root@2core  nginx-1.6.2]# cp /lib64/libpthread.so.0 /nginx/lib64/  
[ root@2core  nginx-1.6.2]# cp /lib64/libcrypt.so.1 /nginx/lib64/  
[ root@2core  nginx-1.6.2]# cp /lib64/libpcre.so.0 /nginx/lib64/  
[ root@2core  nginx-1.6.2]# cp /lib64/libz.so.1 /nginx/lib64/  
[ root@2core  nginx-1.6.2]# cp /lib64/libc.so.6 /nginx/lib64/  
[ root@2core  nginx-1.6.2]# cp /lib64/ld-linux-x86-64.so.2 /nginx/lib64/

cp /lib64/libfreebl3.so /nginx/lib64/

cp /lib64/libdl.so.2 /nginx/lib64/ 

七、複製/etc 到/nginx目錄去，不一樣系統可能有不一樣目錄，若是下面某目錄不存在的話，會有相應的報錯，但不會影響

cp -fv /etc/{group,prelink.cache,services,adjtime,shells,gshadow,shadow,hosts.deny,localtime,nsswitch.conf,nscd.conf,prelink.conf,protocols,hosts,passwd,ld.so.cache,ld.so.conf,resolv.conf,host.conf} $D/etc

cp -avr /etc/{ld.so.conf.d,prelink.conf.d} $D/etc

八、啓動nginx，

pkill -9 nginx

[ root@2core  nginx-1.6.2]# /usr/sbin/chroot /nginx /usr/local/nginx/sbin/nginx -t  
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok  
nginx: [emerg] getpwnam("nginx") failed 
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

上面的報錯是因爲還缺乏一些庫，須要把這些庫複製到/nginx/lib64目錄下， 經過如下命令strace，發現還有庫沒有複製過來

# strace -f -o /tmp/nginx.strace chroot /nginx /usr/local/nginx/sbin/nginx -t

# more /tmp/nginx.strace

8221 open(" /lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 
8221 open("/lib64/tls/x86_64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)  
8221 stat("/lib64/tls/x86_64", 0x7fffa8e430a0) = -1 ENOENT (No such file or directory)  
8221 open("/lib64/tls/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)  
8221 stat("/lib64/tls", 0x7fffa8e430a0) = -1 ENOENT (No such file or directory)  
8221 open("/lib64/x86_64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)  
8221 stat("/lib64/x86_64", 0x7fffa8e430a0) = -1 ENOENT (No such file or directory)  
8221 open("/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)  
8221 stat("/lib64", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0  
8221 open("/usr/lib64/tls/x86_64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)  
8221 stat("/usr/lib64/tls/x86_64", 0x7fffa8e430a0) = -1 ENOENT (No such file or directory)  
8221 open("/usr/lib64/tls/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)  
8221 stat("/usr/lib64/tls", 0x7fffa8e430a0) = -1 ENOENT (No such file or directory)  
8221 open("/usr/lib64/x86_64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)  
8221 stat("/usr/lib64/x86_64", 0x7fffa8e430a0) = -1 ENOENT (No such file or directory)  
8221 open("/usr/lib64/libnss_files.so.2", O_RDONLY) = -1 ENOENT (No such file or directory)  
8221 stat("/usr/lib64", 0x7fffa8e430a0) = -1 ENOENT (No such file or directory)  
8221 munmap(0x7f6818e0d000, 29430) = 0  
8221 write(3, "2014/10/24 17:49:34 [emerg] 8221"..., 99) = 99  
8221 write(2, "nginx: [emerg] getpwnam(\"nginx\")"..., 78) = 78  
8221 close(4) = 0  
8221 write(2, "nginx: configuration file /usr/l"..., 71) = 71  
8221 exit_group(1) = ? 

[ root@2core  nginx-1.6.2]# cp /lib64/libnss_files.so.2 /nginx/lib64/

[ root@2core  nginx-1.6.2]# strace -f -o /tmp/nginx.strace chroot /nginx /usr/local/nginx/sbin/nginx -t  
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok  
nginx: [emerg] open() " /var/log/nginx/access.log" failed (2: No such file or directory)  
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

很明顯，此次報錯是沒有/var/log/nginx/access.log,檢查一下，發現沒有這個/nginx/var/log目錄

[ root@2core  nginx-1.6.2]# mkdir -p /nginx/var/log/nginx  
[ root@2core  nginx-1.6.2]# chmod 777 /nginx/var/log/nginx/  
[ root@2core  nginx-1.6.2]# strace -f -o /tmp/nginx.strace chroot /nginx /usr/local/nginx/sbin/nginx -t  
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok  
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

測試經過

[ root@2core  nginx-1.6.2]# chroot /nginx /usr/local/nginx/sbin/nginx 
[ root@2core  nginx-1.6.2]# ps auxf|grep nginx  
root 8357 0.0 0.0 103240 856 pts/0 S+ 18:04 0:00 \_ grep nginx  
root 8354 0.0 0.0 20212 604 ? Ss 18:04 0:00 nginx: master process /usr/local/nginx/sbin/nginx  
nginx 8355 0.0 0.1 20636 1200 ? S 18:04 0:00 \_ nginx: worker process

至此，部署完成，這時，nginx 便在/nginx這個目錄下運行了，而日誌這些文件都在這個目錄下生成，注意，這時的配置文件在這/nginx/usr/local/nginx/conf/目錄了

# cd /nginx/usr/local/nginx/conf/

# vi nginx.conf

重啓命令

# /usr/sbin/chroot /nginx /usr/local/nginx/sbin/nginx -s reload