Allow users to create and write to a log folder

Question

I'm using Exim4 to run PHP scripts when an email is received.

This script should create a file in the /var/log/myapp folder if it doesn't exist, otherwise it should just read the file and add more content to the log.

I performed some tests applying the 777 permission on the folder and I saw that the user used by Exim4 is nobody.

However, in some cases my administrative user (eg bob) can manually run the PHP file via the PHP CLI and also use these log files.

I ran the commands below to add my user and nobody to write to the folder but only my user can create files, but 'nobody' can't.

sudo groupadd eximapplog

sudo usermod -a -G eximapplog bob
sudo usermod -a -G eximapplog nobody

sudo chgrp -R eximapplog /var/log/myapp
sudo chmod g+rwx /var/log/myapp

sudo chmod -R 775 /var/log/myapp

What could I be doing wrong?

Answer 1

I think the error come the difference in permission levels between your user (bob) and the "nobody" user.

Lets try to adjust the PHP script or Exim4 configuration so that it runs as a specific, non-root user.

First we create new users and new group.

sudo adduser eximappuser
sudo groupadd eximappgroup

Then we add eximappuser and bob to our new group

sudo usermod -a -G eximappgroup eximappuser
sudo usermod -a -G eximappgroup bob

We change the owner rights

sudo chown -R eximappuser:eximappgroup /var/log/myapp

Then we change the rights of var/log/myapp to allow the owner and the group to read, write, and execute

Then you gonna have to configure Exim4 or the PHP script to run as 'eximappuser' instead of 'nobody'