It depends on how nginx is designed. In theory you could separate log writing into a different process, and drop those permissions from the worker process. Or

It depends on how nginx is designed. In theory you could separate log writing into a different process, and drop those permissions from the worker process. Or just write to stdout and have systemd handle the logging for you, that'd work too.