Apache and file system permissions

Question

I'm struggling with this. Lets assume the following:

A user named 'deploy' has a directory in his home directory called example.com. In it, there are a number of files and their permissions are set like so:

drwxrwxrwx 6 deploy deploy 4096 2010-02-10 21:06 example.com

There is also a fresh installation of apache 2 running as www-data:www-data.

I need the files to remain owned by deploy:deploy but I need apache to be able to write to those files.

Shouldn't adding www-data to the deploy group or vice versa, allow apache to write to the example.com directory?

My /etc/groups file shows (Truncated for brevity):

www-data:x:33:deploy
deploy:x:1000:www-data

Yet the www-data user can't write to the directory. It's driving me crazy! Help?

Answer 1

I think the www-data user needs at least read and execute permissions on the parent directory, if not the whole directory path. If the user's home directory is restricted to, say, 700 (drwx------) then that would block group writes in the child directory too. Of course, changing the home directory could have other implications (e.g. for ssh) so you might be better off putting the user's example.com directory under the Apache htdocs area - which potentially reverses the problem, though you've already got the group setup.

Answer 2

Recursively assignment to www-data as owner of the stuff, not just the top folder. It should do

Answer 3

To test your setup you may use

$ sudo -- su -c "ls -l /home/deploy/example.com" www-data

or even

$ sudo -- su -c "touch /home/deploy/example.com/dummy" www-data

to see if you can write to that directory as www-data.