Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I’m trying to set up an environment in which multiple users can work on a single website project. In addition, every one should be able to grant additional write permissions for apache.

The idea is that everyone uses a separate login (lets assume it’s joe, jane and mark in the group users) . The apache is running as apache:www. Everyone has to have write permissions to all the files, apache has read only access. Now, files chosen by the users have to be writable by apache (it’s important that apache cannot have write permissions to all the files — security concerns).

I’ve tried two setups, one using ACL-s, one using umask, common group, etc. Both have the same flaw — users cannot change write permissions for apache.

The two approaches I tried:

  • setfacl -m default:group:users:rwx project/

    This way it’s easy for me to manage write permissions for all the users. No additional setup, just works. Whatever the file owner is, every user of the team can modify the file. Unfortunately, only the file owner can add write permissions for apache

  • umask 0002 in .bashrc, all users in the same group

    Basing on simple permissions, every user has read and write access to all the files. chgrp www ... is needed for apache to have write permissions. Again — only the file owner can do this.

So I’m basically looking for a way to grant multiple users the permission to do a g+w on a file. I thought of other ways of doing it, for example:

  • bash script to change permissions, ran by sudo. Could work, but it’s a security issue. It’s quite complicated for me to restrict it’s access to the project directory only. Even if I do, there will be complications with recursive mode and so on.
  • directory structure like this:
    • /project/www - the apache htdocs (setfacl -m d:group:users:rwx)
    • /project/data - writable by apache (setfacl -m d:user:apache:rwx)
    • whatever in the ./www directory has to be writable by apache, has to be created in ./data and symlinked — but that’s neither elegant or convenient

So I’m looking for a solution that’s easy to use. The initial setup may be complicated, but the every-day use shouldn’t. Any suggestions?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Nothing allows the non-owning, non-root user to change file permissions. I'd go with the sudo'd script -- I don't see what's so hard about it, though. Use readlink -f to canonicalize the filename to change so you can check it's prefix is correct, don't let the user actually specify the permissions, just make it a "grant write access to Apache" script.

share|improve this answer
    
yeah, it seems you’re right. chown doesn’t traverse symlinks by default, so simple prefix check should do the job. –  Maciej Łebkowski Nov 6 '09 at 11:57
    
More than that, though, readlink -f makes sure that there are no symlinks in the path by canonicalising the path. –  womble Nov 6 '09 at 12:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.