Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

sounds like a stupid questions (to me), but i couldn't find any info.

on my server i host some git repositories via gitolite, and have a trac for every repository.

i have a user called git to push/pull from server (git clone git@server:repo). and trac is a apache vhost with mod_wsgi. this runs with the www-data user.

so what riddles me (maybe because I have not much of a clue about file-permissions at all) is whats the best permissions setup (chown, chmod) for the git repositories (/home/git/repositories/...).

www-data (or trac) needs to at least read permissions (i think). and git (or gitolite) needs obviously read/write permissions to push changesets.

i tried a little bit around (i.e. adding www-data and/or git to the www-data/git group), but didn't got it right. at least one of the two don't work (git or trac).

any suggestions are highly appreciated.

regard, klemens

share|improve this question
add comment

2 Answers

The most secure way of doing it I would say is to have a group called git-readers

add git and www-data to it, then have the following folder structure:

/home/git - git:git-readers u=rwx,g=rx,o=
/home/git/repositories - git:git u=rwx,g=rwx,o=rx

This will allow www-data into the folder for reading, but only give the git user write access. Any other user can't do anything.

If you want to add additional writers, I would add another group git-writers and add the users and git to it as well as the git-readers group, then use the following structure:

/home/git - git:git-readers u=rwx,g=rx,o=
/home/git/repositories - git:git-writers u=rwx,g=rwxs,o=rx

Note the 's' in the group permissions. This makes the writer users use git-writers group as their default group. This will only work properly if the writers are all umask 0002.

share|improve this answer
    
perfect thx. fyi: for some reason you need to restart apache after changing the permissions (and creating the git-readers group). seems like this was the problem in the first place, but not sure. –  klemens Dec 20 '10 at 14:20
    
Yes, only new processes gain newly added groups. Restarting apache is needed to do that. –  Andy Dec 20 '10 at 14:30
    
this isn't working. newly created files in the repos have the wrong permissions. could you show me the chmod/own commands precisely. –  klemens Jan 10 '11 at 17:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.