Not breaking permissions when running Rails-related commands on the server

Question

As part of my deployment process I would run a chown -R www-data:www-data in all of /var/www/projectx. That is taking way too long, so instead of periodically fixing permissions, I want to avoid breaking them.

I think one of the reasons why they are broken is because we run Rails-related commands on the server, like:

rvm 1.9.3@projectx && RAILS_ENV=production rake regenerate_thumbnails
rvm 1.9.3@projectx && RAILS_ENV=production bundle exec rails console

and all the files generated during those commands end up being owned by the user running it, instead of www-data.

What would be the proper solution to this issue? I thought of sudoing as www-data to then run the commands, but rvm needs bash and www-data is currently using plain old sh with no profile files, so to make it work I would need to improve www-data's shell environment. Is that the way to go? Any side effect I should watch out for?

Answer 1

It depends on the user you are using to run Rails. By best practice for security, this should be a different user than www-data (which is the user debian-based systems use for apache/nginx owned files). www-data should only own what you export in your static directory.

That said, if the files you are generating are static (such as thumbnails) and you are sourcing rvm from /etc/profile.d/rvm.sh you can try running the following:

sudo -u www-data bash -l -c 'rvm 1.9.3@projectx && RAILS_ENV=production rake regenerate_thumbnails'

This will run the command as www-data, launch a login bash shell instantaneously (which means /etc/profile.d/rvm.sh gets loaded) which in turn runs rvm with your specified gemset and commands.

Remember to host your code outside of the web server's docroot!