In my server I host some git repositories via gitolite, and have a trac for every repository.

I have a user called git to push/pull from server (git clone git@server:repo). and trac is a apache vhost with mod_wsgi. this runs with the www-data user.

So what riddles me (maybe because I have not much of a clue about file-permissions at all) is what's the best permissions setup (chown, chmod) for the git repositories (/home/git/repositories/...).

www-data (or trac) needs to at least read permissions (i think). and git (or gitolite) needs obviously read/write permissions to push changesets.

I tried a little bit around (i.e. adding www-data and/or git to the www-data/git group), but didn't got it right. at least one of the two don't work (git or trac).

any suggestions are highly appreciated.


The most secure way of doing it I would say is to have a group called git-readers

add git and www-data to it, then have the following folder structure:

/home/git - git:git-readers u=rwx,g=rx,o=
/home/git/repositories - git:git u=rwx,g=rwx,o=rx

This will allow www-data into the folder for reading, but only give the git user write access. Any other user can't do anything.

If you want to add additional writers, I would add another group git-writers and add the users and git to it as well as the git-readers group, then use the following structure:

/home/git - git:git-readers u=rwx,g=rx,o=
/home/git/repositories - git:git-writers u=rwx,g=rwxs,o=rx

Note the 's' in the group permissions. This makes the writer users use git-writers group as their default group. This will only work properly if the writers are all umask 0002.

  • perfect thx. fyi: for some reason you need to restart apache after changing the permissions (and creating the git-readers group). seems like this was the problem in the first place, but not sure. – fetzig Dec 20 '10 at 14:20
  • Yes, only new processes gain newly added groups. Restarting apache is needed to do that. – Andy Dec 20 '10 at 14:30
  • this isn't working. newly created files in the repos have the wrong permissions. could you show me the chmod/own commands precisely. – fetzig Jan 10 '11 at 17:09

in case of gitolite push commits to git (gitolite) repository messes up file permissions (no more trac access)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.