Nginx, uwsgi, django. uwsgi работает нормально под обычным пользователем, но не работает при запуске от root, даже с su -u nonroot

Я пытаюсь заставить nginx, Django и uwsgi работать "как указано" в документации (ну, хорошо, https://uwsgi.readthedocs.io/en/latest/tutorials/Django_and_nginx.html в любом случае). Все прекрасно работает, пока я запускаю uwsgi от имени пользователя NON-root.

Пытаясь преодолеть это, я создал небольшой скрипт (закомментированные команды - это то, что я тестировал, извините, если они сбивают с толку):

#!/bin/bash
cd /home/lunchspace/FridayLunch/
uwsgi --ini lunchspace_uswgi.ini
#uwsgi --socket /home/lunchspace/lunchspace.sock --module FridayLunches.wsgi 
#uwsgi --emperor /etc/uwsgi/vassals

Запустив вышеуказанную команду от имени пользователя 'lunchspace', я получаю:

lunchspace@lunchspace:~/FridayLunch$ ../runuwsgi 
[uWSGI] getting INI configuration from lunchspace_uswgi.ini
*** Starting uWSGI 2.0.20 (64bit) on [Fri Sep 23 19:29:55 2022] ***
compiled with version: 7.5.0 on 13 September 2022 22:35:31
os: Linux-4.15.0 #1 SMP Tue Jan 25 12:49:12 MSK 2022
nodename: lunchspace.org
machine: x86_64
clock source: unix
detected number of CPU cores: 1
current working directory: /home/lunchspace/FridayLunch
detected binary path: /usr/local/bin/uwsgi
!!! no internal routing support, rebuild with pcre support !!!
chdir() to /home/lunchspace/FridayLunch
your processes number limit is 62987
your memory page size is 4096 bytes
detected max file descriptor number: 1024
lock engine: pthread robust mutexes
thunder lock: disabled (you can enable it with --thunder-lock)
uwsgi socket 0 bound to UNIX address /home/lunchspace/FridayLunch/lunchspace.sock fd 3
Python version: 3.6.9 (default, Jun 29 2022, 11:45:57)  [GCC 8.4.0]
*** Python threads support is disabled. You can enable it with --enable-threads ***
Python main interpreter initialized at 0x5624343e7df0
your server socket listen backlog is limited to 100 connections
your mercy for graceful operations on workers is 60 seconds
mapped 801944 bytes (783 KB) for 10 cores
*** Operational MODE: preforking ***
at 1
at 2
at 3
at 4
WSGI app 0 (mountpoint='') ready in 0 seconds on interpreter 0x5624343e7df0 pid: 21227 (default app)
*** uWSGI is running in multiple interpreter mode ***
spawned uWSGI master process (pid: 21227)
spawned uWSGI worker 1 (pid: 21229, cores: 1)
spawned uWSGI worker 2 (pid: 21230, cores: 1)
spawned uWSGI worker 3 (pid: 21231, cores: 1)
spawned uWSGI worker 4 (pid: 21232, cores: 1)
spawned uWSGI worker 5 (pid: 21233, cores: 1)
spawned uWSGI worker 6 (pid: 21234, cores: 1)
spawned uWSGI worker 7 (pid: 21235, cores: 1)
spawned uWSGI worker 8 (pid: 21236, cores: 1)
spawned uWSGI worker 9 (pid: 21237, cores: 1)
spawned uWSGI worker 10 (pid: 21238, cores: 1)
Request is
<WSGIRequest: GET '/'>
GET
<QueryDict: {}>
request.user
rustycar54@descomp.com
request.user.is_authenticated
True
Restaurantlist: 
None Haji Baba's
None Haji Baba's
[pid: 21232|app: 0|req: 1/1] 172.56.80.241 () {46 vars in 810 bytes} [Fri Sep 23 12:29:58 2022] GET / => generated 53021 bytes in 119 msecs (HTTP/1.1 200) 5 headers in 287 bytes (2 switches on core 0)
^CSIGINT/SIGTERM received...killing workers...
worker 1 buried after 9 seconds
worker 2 buried after 9 seconds
worker 3 buried after 9 seconds
worker 4 buried after 9 seconds
worker 5 buried after 9 seconds
worker 6 buried after 9 seconds
worker 7 buried after 9 seconds
worker 8 buried after 9 seconds
worker 9 buried after 9 seconds
worker 10 buried after 9 seconds
goodbye to uWSGI.
VACUUM: unix socket /home/lunchspace/FridayLunch/lunchspace.sock removed.

А веб-сайт работает нормально.

меняя права root и запуская под именем lunchspace через sudo -u, я получаю:

root@lunchspace:~# echo foo;sudo -iu lunchspace /home/lunchspace/runuwsgi 
foo
[uWSGI] getting INI configuration from lunchspace_uswgi.ini
*** Starting uWSGI 2.0.20 (64bit) on [Fri Sep 23 19:30:27 2022] ***
compiled with version: 7.5.0 on 13 September 2022 22:35:31
os: Linux-4.15.0 #1 SMP Tue Jan 25 12:49:12 MSK 2022
nodename: lunchspace.org
machine: x86_64
clock source: unix
detected number of CPU cores: 1
current working directory: /home/lunchspace/FridayLunch
detected binary path: /usr/local/bin/uwsgi
!!! no internal routing support, rebuild with pcre support !!!
chdir() to /home/lunchspace/FridayLunch
your processes number limit is 62987
your memory page size is 4096 bytes
detected max file descriptor number: 1024
lock engine: pthread robust mutexes
thunder lock: disabled (you can enable it with --thunder-lock)
uwsgi socket 0 bound to UNIX address /home/lunchspace/FridayLunch/lunchspace.sock fd 3
Python version: 3.6.9 (default, Jun 29 2022, 11:45:57)  [GCC 8.4.0]
*** Python threads support is disabled. You can enable it with --enable-threads ***
Python main interpreter initialized at 0x562b734334e0
your server socket listen backlog is limited to 100 connections
your mercy for graceful operations on workers is 60 seconds
mapped 801944 bytes (783 KB) for 10 cores
*** Operational MODE: preforking ***
at 1
at 2
at 3
at 4
WSGI app 0 (mountpoint='') ready in 0 seconds on interpreter 0x562b734334e0 pid: 21362 (default app)
*** uWSGI is running in multiple interpreter mode ***
spawned uWSGI master process (pid: 21362)
spawned uWSGI worker 1 (pid: 21364, cores: 1)
spawned uWSGI worker 2 (pid: 21365, cores: 1)
spawned uWSGI worker 3 (pid: 21366, cores: 1)
spawned uWSGI worker 4 (pid: 21367, cores: 1)
spawned uWSGI worker 5 (pid: 21368, cores: 1)
spawned uWSGI worker 6 (pid: 21369, cores: 1)
spawned uWSGI worker 7 (pid: 21370, cores: 1)
spawned uWSGI worker 8 (pid: 21371, cores: 1)
spawned uWSGI worker 9 (pid: 21372, cores: 1)
spawned uWSGI worker 10 (pid: 21373, cores: 1)
^CSIGINT/SIGTERM received...killing workers...
worker 1 buried after 2 seconds
worker 2 buried after 2 seconds
worker 3 buried after 2 seconds
worker 4 buried after 2 seconds
worker 5 buried after 2 seconds
worker 6 buried after 2 seconds
worker 7 buried after 2 seconds
worker 8 buried after 2 seconds
worker 9 buried after 2 seconds
worker 10 buried after 2 seconds
goodbye to uWSGI.
VACUUM: unix socket /home/lunchspace/FridayLunch/lunchspace.sock removed.
root@lunchspace:~#  

а веб-сайт говорит "502 Bad Gateway'

Я посмотрел журнал nginx и увидел

<blah> request: "GET / HTTP/1.1", upstream: "uwsgi://unix:///home/lunchspace/FridayLunch/lunchspace.sock:", host: <blah>

Итак, я говорю себе - О, легко, здесь нет файла сокета lunchspace.sock. Но, вот, он есть:

root@lunchspace:~# ls -l /home/lunchspace/FridayLunch/lunchspace.sock 
srwxr-xr-x 1 lunchspace lunchspace 0 Sep 23 19:39 /home/lunchspace/FridayLunch/lunchspace.sock
root@lunchspace:~# 

Упс. Обратите внимание на разрешения! Я изменил их на 777 (не очень хорошо в долгосрочной перспективе, я знаю), и альт! Все работает.

Итак, рискуя быть отмеченным как идиот за ответ на мой собственный вопрос в вопросительном посте, я собираюсь пойти вперед и опубликовать это в надежде, что это сэкономит кому-то еще много времени и разочарования.

Короткий ответ:

Убедитесь, что разрешения файла сокета позволяют процессу nginx писать в него и читать из него.

(В моем случае мне понадобилось 664, так как процесс nginx был в правильной группе. Установите это в вашем файле *.ini)

chmod-socket    = 664