2

I have a web application running on Linux (using CentOS 6) using a generic non-root user name, say app1. I've associated all the files under the folder /home/app1 with that user/group (using chown -R app1:app1) so it can serve up web pages and write to logs as necessary. When it comes to updates though I'm trying to figure out how to handle permissions so that I don't need to constantly run the chown command on the /home/app1 directory. There's a requirement to log in to the server with a unique id so if devguy1 logs in and copies an update the files he wrote over now have devguy1 as the owner and group and the app1 won't be able to read the new file. Devguy1 is part of the app1 group so they can update the app but not vice versa. I see that there's a way to copy files using cp -p that will preserve permissions but we're usually using Beyond Compare to move updates from our Dev server to production which doesn't have that option. Is there a setting on the parent folder that could make the file keep the app1 owner/group info or is there a way that when a new user is created that I could add app1 to their group?

  • You can easily make app1 their default group, you can make the directories sticky, so the group owner gets propagated that way. Or you could share the directory to the people as NFS or SMB share, and have the owning process set user/group ... quite a few ways, really. – tink Sep 24 '14 at 23:54
1

Set the setuid and setgid bits on all of the directories under /home/app1:

find /home/app1 -type d -exec chmod ug+s '{}' +

(See man find to learn about the find command, and man chmod to learn about the setuid and setgid bits.) That causes the user and group owners to be preserved when new files and directories are created in any of the existing directories.

I believe there are cases that will still ignore the suid and sgid bits, like saving to SMB shares, or copying with permissions intact using cp -p. But for the most part, it should work.

  • Thought it wasn't working at first (trying really hard not to do things as root these days) but just added the magic word sudo after -exec and it's doing exactly what I need. Thanks! – displayNameGoesHere Nov 6 '14 at 4:58
2

Another option, which isn't strictly what you are asking for is to use the posix ACL facility.

Here's an example that I use to maintain permissions on a structure based on a local group in addition to the owning userid:

# Do this once or occasionally, but only cosmetic
chown -R network:network /local/network

setfacl -R -m user:network:rwx /local/network
setfacl -R -dm user:network:rwx /local/network

setfacl -R -m group:it-neteng-users:rwx /local/network
setfacl -R -dm group:it-neteng-users:rwx /local/network

On very old kernels, you might need to have your filesystem mounted with the 'acl' option for this to be available, but that shouldn't be necessary on anything reasonably modern.

In your case, you'd likely want to use the acl'ing to grant web server perms to read the files, then the ownership won't actually matter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.