Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My setup is the following:

Multiple users coding for the one website
Each user has their own username/group
Websites are located in /usr/local/ourcompany/websites/sitename/*

./websites/ is owned by me:ourcompany. I set this folder and all it's subfolders to be writable by group. chmod g+ws websites

This takes care of most the permission issues. It allows everyone in the ourcompany group to edit the website files. The problem is when uploading files via PHP.

PHP is running as www-data. This seems to break the setuid group writable setting.

I'm running Nginx, if that's relevant...

Any tips?

share|improve this question
    
Just a comment as I can't offer a solution: The issue is that, although you've got group-sticky on the folders, that doesn't apply to newly created files, which take on the system-wide umask. Most common linuxes have the umask set at 0022 (= rwxr-xr-x). You could set that to 0002 (= rwxrwxr-x), But I'm going to staple the words 'Massive Security Hole' to that as a warning. It's not possible to set per-directory umasks. :) –  SmallClanger Nov 16 '10 at 15:19
add comment

2 Answers

I will do it this way:

1- Keep the working permissions as you have it.

2- Upload the files via PHP to a different (temporary) directory. This temp directory should be writable by www-data user.

3- Write a simple script to copy/move the uploaded files from the temp directory to the desired path /usr/local/ourcompany/websites/sitename/*. Then, you can chown/chmod the new files to make sure the permissions are preserved as you upload more files. This script will be executed as root as explained in the next point.

4- Add the www-data user to sudoers file. Use sudo visudo to edit it. So, the www-data user will execute the shell script (created in point 3) as super user without a password. You need to name the script in the sudoers file to restrict this permission to this signle shell script.

share|improve this answer
add comment

You PHP upload script is probably a very specific one, like /upload/up_script.php

In which case, I would create a specific location in the nginx's config, and execute those queries with a php5-cgi process runned by a member of "ourcompany" (instead of www-data). The rest of the code can (should) still be executed by a user that doesn't have write permissions on the website files.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.