Folder permissions for Apache vhost files on Samba share

Question

In our website development environment, we have a central CentOS server running multiple vhosts via Apache. The vhost files are shared via SMB. Multiple developers in the office connect to this SMB share (from OSX clients) in order to create and edit files and folders for website development.

This SMB share is configured to force the owner and group of all edited or created files (via SMB) to be apache. Therefore, all files in all the vhost directories are owned by apache:apache in order to ensure Apache has proper permissions to access them.

Sometimes however, certain actions require sudo to accomplish things. For example if a user needs to SSH into the server in order to move or copy files around (much faster via SSH instead of over SMB), or maybe make git commits of the files, etc. You can't sudo as apache for these actions because you aren't technically able to login as apache.

As a result most developers will make their git commits/pushes/pulls using sudo and then running chown apache:apache . -R on the entire vhost directory.

This doesn't seem like the proper way to go about this. I'm trying to figure out the best course of action moving forward. All users are also in the apache group, but if they happen to create new files via SSH (maybe a git pull added new files) then those files are now owned by that user instead of apache, again causing them to chown everything again.

Is there a better workflow for this kind of setup?

Answer 1

The way I have set this up in the past is to have all of the devs in the apache group ( which you have already done ) and then set group write on the vhost directory and group sticky bit on the vhost directory ( chmod g+ws ). This should force all files to get created with group set to apache and read / write permissions. You will end up with the individual accounts owning the files but as long as group has write it shouldn't matter. Also this requires that the default umask of 0002 is still in place.