1

I have a webserver where apache runs as www-data. Users are set up using chef, and some of their file/folder permissions are set to group: www-data, e.g. uploads folders.

Deployments are done with Capistrano, using the user account. It would be useful if during deployment, Capistrano could also change the group of files/folders to www-data.

How could I configure this, whilst maintaining security? I'm thinking an entry in the sudoers file that allows <user> to execute chgrp www-data /home/<user>/* whilst ensuring that the command does not contain ...

Improve this question
1

1 Answer 1

Reset to default
3

You might be best off writing a script and enabling that in sudoers. If your users will only ever need to run it on * within their homedir then something as simple as the following. It makes use of the SUDO_USER environment variable which you can find out more about here: http://www.sudo.ws/sudo/sudo.man.html#environment

chgrp www-data /home/`echo $SUDO_USER`/*

I haven't tested this but it should work in principal.

Improve this answer
2
  • Thanks. I think I'll have to write a wrapper script as you say. the * was meaning anything, rather than specifically * in the command, so it's not possible to protect against .. in the path, and symlinks pointing elsewhere on the system.
    – Colin
    Sep 10, 2013 at 8:55
  • In the spirit of being over paranoid, would welcome any feedback on this - which is first draft to solve the problem - gist.github.com/colinbm/6507094
    – Colin
    Sep 10, 2013 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .