[nodesocket]

What other NGINX directive paths besides "client_body_temp_path" actually change the owner on-startup?

Seems like NGINX logic should be, if the path exists, it must have correct permissions already. If not, just fail to start.

[TarqDirtyToMe]

All of the client_*_temp_path behave this way so you can actually change multiple files with one payload.

I am sure there are other ones but I have not had a chance to investigate further. Another commented mentioned this particular problem is in ngx_create_paths so that would be a good place to start looking.

The key is to find paths that happen in the master process, not the workers.