Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a shared hosting server with nginx and php-fpm on Debian.

Everything works fine, php-fpm has separate pools for each users running as separate users and they each have their own socks.

Nginx is however running as www-data because I don't want to have separate nginx processes for each user.

This means that in order for nginx to have access to the users data, the permissions of /home have to be drwxr-x--x. The problem is, all users have access to other users files.

What would be the best way to give nginx access to the users files without giving other users access. Running nginx as root is not an option. But would AppArmor help?

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

I prefer to use ACLs for this. For instance:

setfacl -R -m user:www-data:rx,d:user:www-data:rx /home

Gives the www-data user access to read files and traverse directories under /home, and applies the same ACL to any new files or directories created later.

Once applied, user home directories no longer have to be world-executable, thus users can no longer read each other's files, but nginx can.

share|improve this answer
    
Wow, that was quick. Thanks, that works perfectly! –  dBi Mar 5 '13 at 13:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.