Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As part of my deployment process I would run a chown -R www-data:www-data in all of /var/www/projectx. That is taking way too long, so instead of periodically fixing permissions, I want to avoid breaking them.

I think one of the reasons why they are broken is because we run Rails-related commands on the server, like:

rvm 1.9.3@projectx && RAILS_ENV=production rake regenerate_thumbnails
rvm 1.9.3@projectx && RAILS_ENV=production bundle exec rails console

and all the files generated during those commands end up being owned by the user running it, instead of www-data.

What would be the proper solution to this issue? I thought of sudoing as www-data to then run the commands, but rvm needs bash and www-data is currently using plain old sh with no profile files, so to make it work I would need to improve www-data's shell environment. Is that the way to go? Any side effect I should watch out for?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

It depends on the user you are using to run Rails. By best practice for security, this should be a different user than www-data (which is the user debian-based systems use for apache/nginx owned files). www-data should only own what you export in your static directory.

That said, if the files you are generating are static (such as thumbnails) and you are sourcing rvm from /etc/profile.d/rvm.sh you can try running the following:

sudo -u www-data bash -l -c 'rvm 1.9.3@projectx && RAILS_ENV=production rake regenerate_thumbnails'

This will run the command as www-data, launch a login bash shell instantaneously (which means /etc/profile.d/rvm.sh gets loaded) which in turn runs rvm with your specified gemset and commands.

Remember to host your code outside of the web server's docroot!

share|improve this answer
    
www-data should not own static resources. It should only own upload directories for files uploaded from the browser, and the files therein. –  Michael Hampton Nov 27 '12 at 12:52
    
Actually, in the default umask, nothing should be owned by www-data, since the web server should have no reason whatsoever in writing/executing any of your files. You can allow o+r on statc files and o+rx on static directories to allow the web server to read your assets (js, css, image files) (or uploads, but this only if need exposing them uploads directly to your users). –  Panagiotis PJ Papadomitsos Nov 29 '12 at 15:27
    
When running that line I get this error: bash: /root/.bash_profile: Permission denied –  J. Pablo Fernández Dec 6 '12 at 10:12
    
Adding -H helped with the permission error. –  J. Pablo Fernández Dec 6 '12 at 10:21
    
Try cd'ing in your codebase first! –  Panagiotis PJ Papadomitsos Dec 10 '12 at 10:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.