静态编译nginx

目录

背景

难点

2种解决方法

1. 去掉NSS功能，缺点是不能以root权限运行

2. 依赖musl库

---

背景

为了便于离线安装nginx，不依赖任何第三方库

难点

官方的nginx依赖 Name Service Switch, 这个NSS允许系统管理员重新配置系统以使用外部源来获取通常从 /etc/passwd、/etc/shadow、/etc/hosts、/etc/groups、/etc/resolv.conf 等查询的内容。不能编译成完全静态的可执行文件。

2种解决方法

1. 去掉NSS功能，缺点是不能以root权限运行

需要打补丁：

diff --git a/src/core/nginx.c b/src/core/nginx.c
index 3213527..f61aed7 100644
--- a/src/core/nginx.c
+++ b/src/core/nginx.c
@@ -1030,29 +1030,10 @@ ngx_core_module_init_conf(ngx_cycle_t *cycle, void *conf)
 #if !(NGX_WIN32)
 
     if (ccf->user == (uid_t) NGX_CONF_UNSET_UINT && geteuid() == 0) {
-        struct group   *grp;
-        struct passwd  *pwd;
-
-        ngx_set_errno(0);
-        pwd = getpwnam(NGX_USER);
-        if (pwd == NULL) {
-            ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
-                          "getpwnam(\\"" NGX_USER "\\") failed");
-            return NGX_CONF_ERROR;
-        }
-
-        ccf->username = NGX_USER;
-        ccf->user = pwd->pw_uid;
-
-        ngx_set_errno(0);
-        grp = getgrnam(NGX_GROUP);
-        if (grp == NULL) {
-            ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
-                          "getgrnam(\\"" NGX_GROUP "\\") failed");
-            return NGX_CONF_ERROR;
-        }
-
-        ccf->group = grp->gr_gid;
+        ngx_set_errno(ENOSYS);
+        ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
+                      "getpwnam(\\"" NGX_USER "\\") disabled for static build");
+        return NGX_CONF_ERROR;
     }
 
 
@@ -1122,9 +1103,6 @@ ngx_set_user(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     ngx_core_conf_t  *ccf = conf;
 
-    char             *group;
-    struct passwd    *pwd;
-    struct group     *grp;
     ngx_str_t        *value;
 
     if (ccf->user != (uid_t) NGX_CONF_UNSET_UINT) {
@@ -1143,29 +1121,10 @@ ngx_set_user(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 
     ccf->username = (char *) value[1].data;
 
-    ngx_set_errno(0);
-    pwd = getpwnam((const char *) value[1].data);
-    if (pwd == NULL) {
-        ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
-                           "getpwnam(\\"%s\\") failed", value[1].data);
-        return NGX_CONF_ERROR;
-    }
-
-    ccf->user = pwd->pw_uid;
-
-    group = (char *) ((cf->args->nelts == 2) ? value[1].data : value[2].data);
-
-    ngx_set_errno(0);
-    grp = getgrnam(group);
-    if (grp == NULL) {
-        ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
-                           "getgrnam(\\"%s\\") failed", group);
-        return NGX_CONF_ERROR;
-    }
-
-    ccf->group = grp->gr_gid;
-
-    return NGX_CONF_OK;
+    ngx_set_errno(ENOSYS);
+    ngx_conf_log_error(NGX_LOG_EMERG, cf, ngx_errno,
+                       "getpwnam(\\"%s\\") disabled for static build", value[1].data);
+    return NGX_CONF_ERROR;
 
 #endif
 }
diff --git a/src/core/ngx_inet.c b/src/core/ngx_inet.c
index 96a04fd..4ab2f7f 100644
--- a/src/core/ngx_inet.c
+++ b/src/core/ngx_inet.c
@@ -1111,95 +1111,9 @@
 }
 
 
-#if (NGX_HAVE_GETADDRINFO && NGX_HAVE_INET6)
-
-ngx_int_t
-ngx_inet_resolve_host(ngx_pool_t *pool, ngx_url_t *u)
-{
-    u_char           *host;
-    ngx_uint_t        n;
-    struct addrinfo   hints, *res, *rp;
-
-    host = ngx_alloc(u->host.len + 1, pool->log);
-    if (host == NULL) {
-        return NGX_ERROR;
-    }
-
-    (void) ngx_cpystrn(host, u->host.data, u->host.len + 1);
-
-    ngx_memzero(&hints, sizeof(struct addrinfo));
-    hints.ai_family = AF_UNSPEC;
-    hints.ai_socktype = SOCK_STREAM;
-#ifdef AI_ADDRCONFIG
-    hints.ai_flags = AI_ADDRCONFIG;
-#endif
-
-    if (getaddrinfo((char *) host, NULL, &hints, &res) != 0) {
-        u->err = "host not found";
-        ngx_free(host);
-        return NGX_ERROR;
-    }
-
-    ngx_free(host);
-
-    for (n = 0, rp = res; rp != NULL; rp = rp->ai_next) {
-
-        switch (rp->ai_family) {
-
-        case AF_INET:
-        case AF_INET6:
-            break;
-
-        default:
-            continue;
-        }
-
-        n++;
-    }
-
-    if (n == 0) {
-        u->err = "host not found";
-        goto failed;
-    }
-
-    /* MP: ngx_shared_palloc() */
-
-    for (rp = res; rp != NULL; rp = rp->ai_next) {
-
-        switch (rp->ai_family) {
-
-        case AF_INET:
-        case AF_INET6:
-            break;
-
-        default:
-            continue;
-        }
-
-        if (ngx_inet_add_addr(pool, u, rp->ai_addr, rp->ai_addrlen, n)
-            != NGX_OK)
-        {
-            goto failed;
-        }
-    }
-
-    freeaddrinfo(res);
-    return NGX_OK;
-
-failed:
-
-    freeaddrinfo(res);
-    return NGX_ERROR;
-}
-
-#else /* !NGX_HAVE_GETADDRINFO || !NGX_HAVE_INET6 */
-
 ngx_int_t
 ngx_inet_resolve_host(ngx_pool_t *pool, ngx_url_t *u)
 {
-    u_char              *host;
-    ngx_uint_t           i, n;
-    struct hostent      *h;
     struct sockaddr_in   sin;
 
     /* AF_INET only */
@@ -1210,37 +1124,8 @@
     sin.sin_addr.s_addr = ngx_inet_addr(u->host.data, u->host.len);
 
     if (sin.sin_addr.s_addr == INADDR_NONE) {
-        host = ngx_alloc(u->host.len + 1, pool->log);
-        if (host == NULL) {
-            return NGX_ERROR;
-        }
-
-        (void) ngx_cpystrn(host, u->host.data, u->host.len + 1);
-
-        h = gethostbyname((char *) host);
-
-        ngx_free(host);
-
-        if (h == NULL || h->h_addr_list[0] == NULL) {
-            u->err = "host not found";
-            return NGX_ERROR;
-        }
-
-        for (n = 0; h->h_addr_list[n] != NULL; n++) { /* void */ }
-
-        /* MP: ngx_shared_palloc() */
-
-        for (i = 0; i < n; i++) {
-            sin.sin_addr.s_addr = *(in_addr_t *) (h->h_addr_list[i]);
-
-            if (ngx_inet_add_addr(pool, u, (struct sockaddr *) &sin,
-                                  sizeof(struct sockaddr_in), n)
-                != NGX_OK)
-            {
-                return NGX_ERROR;
-            }
-        }
-
+        u->err = "gethostbyname disabled for static build";
+        return NGX_ERROR;
     } else {
 
         /* MP: ngx_shared_palloc() */
@@ -1256,8 +1141,6 @@
     return NGX_OK;
 }
 
-#endif /* NGX_HAVE_GETADDRINFO && NGX_HAVE_INET6 */
-
 
 static ngx_int_t
 ngx_inet_add_addr(ngx_pool_t *pool, ngx_url_t *u, struct sockaddr *sockaddr,
diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c
index 5817a2c..8262993 100644
--- a/src/os/unix/ngx_process_cycle.c
+++ b/src/os/unix/ngx_process_cycle.c
@@ -833,12 +833,6 @@ ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker)
             exit(2);
         }
 
-        if (initgroups(ccf->username, ccf->group) == -1) {
-            ngx_log_error(NGX_LOG_EMERG, cycle->log, ngx_errno,
-                          "initgroups(%s, %d) failed",
-                          ccf->username, ccf->group);
-        }
-
 #if (NGX_HAVE_PR_SET_KEEPCAPS && NGX_HAVE_CAPABILITIES)
         if (ccf->transparent && ccf->user) {
             if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {

参考： https://github.com/ericpruitt/static-glibc-nginx

2. 依赖musl库

musl libc

musl 从头开始设计用于静态链接，功能和效率跟glibc一样，宗旨：“一次编写到处运行”

wanglong001/static-glibc-nginx