1

I have a webserver where apache runs as www-data. Users are set up using chef, and some of their file/folder permissions are set to group: www-data, e.g. uploads folders.

Deployments are done with Capistrano, using the user account. It would be useful if during deployment, Capistrano could also change the group of files/folders to www-data.

How could I configure this, whilst maintaining security? I'm thinking an entry in the sudoers file that allows <user> to execute chgrp www-data /home/<user>/* whilst ensuring that the command does not contain ...

3

You might be best off writing a script and enabling that in sudoers. If your users will only ever need to run it on * within their homedir then something as simple as the following. It makes use of the SUDO_USER environment variable which you can find out more about here: http://www.sudo.ws/sudo/sudo.man.html#environment

chgrp www-data /home/`echo $SUDO_USER`/*

I haven't tested this but it should work in principal.

  • Thanks. I think I'll have to write a wrapper script as you say. the * was meaning anything, rather than specifically * in the command, so it's not possible to protect against .. in the path, and symlinks pointing elsewhere on the system. – Colin Sep 10 '13 at 8:55
  • In the spirit of being over paranoid, would welcome any feedback on this - which is first draft to solve the problem - gist.github.com/colinbm/6507094 – Colin Sep 10 '13 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.