I have a service running on a linux box, started with upstart, that runs as user "the_user", it has to read a config file. Having the file owned by root would make things more secure, but would prevent the service reading the file.
I know that nginx can read a private cert file owned by root while running as a non root user.
I read about the approach or sourcing a script that sets sensitive environment variables read from a root owned file, and then launching the service process as the service user, which then "inherits" from the environment variables.
What is the best approach ?