User permissions for both apache and local user

Question

I'm trying to allow permissions to files on the /home/user1/public_html/ folder for both user1 and for www-data (apache).

I've been instructed to run these commands:

sudo chown -R www-data:user1 /home/user1/public_html/
sudo chmod g+s /home/user1/public_html/

Now, www-data does have access to edit/remove/add files to /home/user1/public_html/ but user1 cannot edit anything.

How can I solve this?

Thanks,

Answer 1

The best way to achieve this is with posix ACLs. Standard unix file permissions dont really cut it. You can do it with some kludging but its not really more than a kludge, basically its not a straight-forward solution.

Using a ACL will resolve this issue succintly. To do this you can use the following commands:

setfacl -R -m www-user:rwx /home/user1/public_html
setfacl -R -d -m www-user:rwx /home/user1/public_html
setfacl -R -m user1:rwx /home/user1/public_html
setfacl -R -d -m user1:rwx /home/user1/public_html

The -d flag causes new files to inherit the ACLs you set in the directory.

There are some caveats to bear in mind.

1. Your filesystem must support it (most do these days, they can be enabled by remounting the filesystem with ACL support on most filesystems). Stuff like NFS wont work.
2. The standard Unix group ACL becomes a mask. I.E if a file says g+x the file is executable with the command above. if its g-x the file is not executable, regardless of whether or not permissions set are rwx in the ACL. This ensures you avoid a situation where you would have to mark all directories rwx in the acl and all files rw-.

This fixes a problem sensibly and permits various combinations of scenarios:

• It enforces least privilege as you are not required to start modifying group memberships of users.
• user1 can create a file which can be modified later by www1-user (so user1 can SFTP upload content which could be deleted and/or modified by a CMS in apache later) and visa versa.
• Apache remains in a system account which avoids having to use SetUID workarounds to change the apache subject (user).
• The modification applies within a specific directory structure only and wont inadvertently permit www-user or user1 access to other portions of the file system tree you would not wish them to access.
• Altering or revoking permissions is a trivial change.

This is my preferred way to resolve these kind of issues. It is a simple, non-disruptive and trivial change.

Answer 2

Apache doesn't need to write everywhere, for this you can specify tmp,upload,etc. folders. So you can set permissions for public_dir to be readable and executable by apache user:

sudo chown user1:www-data /home/user1/public_html
sudo chmod 0750 /home/user1/public_html

All other files under public_html dir can be under user1 permissions and only readable by "others" (apache here). This is also better from security view. As I wrote, only necessary files/folder should be writable by apache user.

Answer 3

The simplest solution is to ensure that www-data can navigate all the directories to /home/user1/public_html directory and use 755 directory permissions from public_html and down. Files in the public_html directory need to be world (other) readable. These command should enable access:

sudo chmod o+x /home
sudo chmod 0+x /home/user1
find /home/user1/public_html -type d ! -perm -005 -print0 | xargs -0 sudo chmod o+rx
find /home/user1/public_html -type f ! -perm -004 -print0 | xargs -0 sudo chmod o+r

The first command is likely not required. Some systems restrict access to home directories fairly severely, and this is fixed by the second command. It does allow files to opened within the home directory, but does not grant the ability to list the directory.

The last three commands can be run by the user with sudo removed.

Answer 4

If you did:

sudo chown -R www-data:user1 /home/user1/public_html/

You gave ownership to the user www-data and the group user1.

With:

sudo chmod g+s /home/user1/public_html/

You set the group ID on execution on this folder, I have never seen this done before and I have no idea why one would do this... It's usually used on binaries. You are messing things up with this. Unless you find a valid reason for doing it, reverse that:

sudo chmod g-s /home/user1/public_html/

And set read/write permissions fore both the user1 (which belongs to the group user1) and www-data.

sudo chmod -R 770 /home/user1/public_html

And now you have everyfile writable and readable by www-data and all users in the user1 group (which I assume only user1 is part of, double check it).

This is dirty since you may want some files to be writable only by the user. As a developer, it's not uncommon to "upload" files on the server instead of just editing them, this solves the right management issues by outsourcing it to a secure program as sftp/scp. You could even try to use a SCM.

Answer 5

You most likely have user1 and www-data the wrong way round in the commands in the question.

You don't want to give apache write permissions by default - and making the apache user the owner is going to do exactly that.

Try this:

sudo chown -R user1:www-data /home/user1/public_html/
sudo find /home/user1/public_html/ -type d -exec chmod 0755 {} \; -or -type f -exec chmod 0644 {} \;

That will make you the owner, and use the same group as apache, then reset permissions to 755 for folders and 644 for files. the 7 5 5 and 6 4 4 permissions are the ones that would apply to apache - only give apache write permissions to the folders it absolutely needs to write to.