init

results/scripts/run-audit-permissions.sh

@@ -0,0 +1,56 @@
+#!/bin/sh
+# Audit: minimal permissions (docs/Минимально_необходимые_полномочия_nginx)
+set -eu
+
+REPORT="${REPORT:-/reports/audit.log}"
+
+section() { echo "" >> "$REPORT"; echo "=== $1 ===" >> "$REPORT"; echo "=== $1 ==="; }
+
+: > "$REPORT"
+echo "Permissions audit $(date -Iseconds)" >> "$REPORT"
+
+section "Worker user"
+nginx -T 2>/dev/null | grep '^user ' >> "$REPORT" || true
+ps aux | grep 'nginx:' >> "$REPORT" || true
+
+section "Config permissions"
+ls -la /etc/nginx/ >> "$REPORT"
+namei -l /etc/nginx/nginx.conf >> "$REPORT" 2>/dev/null || ls -l /etc/nginx/nginx.conf >> "$REPORT"
+if su -s /bin/sh nginx -c 'test -w /etc/nginx/nginx.conf' 2>/dev/null; then
+  echo "FAIL: nginx can write nginx.conf" >> "$REPORT"
+else
+  echo "OK: nginx cannot write nginx.conf" >> "$REPORT"
+fi
+
+section "Web root permissions"
+ls -la /usr/share/nginx/html/public/ >> "$REPORT"
+if su -s /bin/sh nginx -c 'test -w /usr/share/nginx/html/public/index.html' 2>/dev/null; then
+  echo "FAIL: nginx can write web root" >> "$REPORT"
+else
+  echo "OK: nginx cannot write web root" >> "$REPORT"
+fi
+
+section "TLS certificates and keys"
+ls -la /etc/nginx/ssl/ >> "$REPORT"
+if su -s /bin/sh nginx -c 'cat /etc/nginx/ssl/server.key' 2>/dev/null; then
+  echo "FAIL: nginx can read private key" >> "$REPORT"
+else
+  echo "OK: nginx cannot read private key" >> "$REPORT"
+fi
+
+section "htpasswd"
+ls -la /etc/nginx/htpasswd >> "$REPORT" 2>/dev/null || true
+if su -s /bin/sh nginx -c 'test -w /etc/nginx/htpasswd' 2>/dev/null; then
+  echo "FAIL: nginx can write htpasswd" >> "$REPORT"
+else
+  echo "OK: nginx cannot write htpasswd" >> "$REPORT"
+fi
+
+section "Logs"
+ls -la /var/log/nginx/ >> "$REPORT"
+
+section "Temp/cache paths"
+ls -la /var/cache/nginx/ >> "$REPORT" 2>/dev/null || echo "cache dir not yet created" >> "$REPORT"
+nginx -T 2>/dev/null | grep -E 'client_body_temp_path|proxy_temp_path' >> "$REPORT" || true
+
+echo "Audit permissions complete -> $REPORT"