Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to give my website the permission to read files & folders from a Dropbox subfolder.

I think I have added the correct permissions, but I can't get the www-data user to get access to the folders.

$ cd /home/edent/Dropbox
$ ls -la
total 9944
drwxrwxr-x    6 edent edent       4096 Aug 14  2012 .
drwx------   67 edent edent      20480 Feb 27 09:11 ..
drwxrwxr-x+ 772 edent www-data  118784 Jan 29 20:45 Foo
drwxrwxr-x    4 edent edent       4096 Aug 14  2012 Bar

All the sub-folders and files of Foo are also drwxrwxr-x+ edent www-data

So, I switch to the user www-data but it doesn't have permission to access those files and folders!

$ sudo su www-data
$ groups
www-data
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ cd /home/edent/Dropbox/Foo
sh: 3: cd: can't cd to /home/edent/Dropbox/Foo

However, if I start in /home/edent/Dropbox/Foo I can access files but not directories.

$ cd ~/Dropbox/Foo/
$ sudo su www-data
$ ls
(file listing)
$ tail example.txt
(file displayed)
$ cd Bar/
sh: 4: cd: can't cd to Bar

What am I doing wrong? All I want is for Apache to access a limited set of folders - I don't want to open up my entire filesystem.

share|improve this question

2 Answers 2

This is because the permissions are checked at every level to get to a directory, not just the target directory. You can give a user or group permission to pass though a directory without being able to access what is inside it by setting the execute bit for that user or group without setting either the read or write bits.

For example:

chmod 710 /home/$USER
chmod 710 /home/edent/Dropbox
chmod 750 /home/edent/Dropbox/Foo

But for this to work you will need the group for all these levels to be www-data. This is somewhat untidy as having to change the group of your home directory just for one specific scenario may conflict with other things you want to do later.

If you have root on the host an tidier solution is to use a bind mount. In /etc/fstab add something like:

/home/edent/Dropbox/foo /var/www/html/foo none bind 0 0

This should make the directory in Dropbox appear in the /var/www/html directory, irrelevant of any other file system permissions. Now you only need to worry about file permissions within that directory and not in the hierarchy above that. You can think of this as a super symlink that can span file systems. For example, I make use of this in a machine with a small SSD drive for / and all my large media files are on a separate larger disc. I Make it look like those media files are in my home directory with:

/media/bigdrive/media /home/me/media none bind 0 0
share|improve this answer
    
Yes, I like your second solution, much better! –  X Tian Feb 27 at 13:30
    
Trying your second solution, I get the message "An error occurred while mounting /var/www/Foo" –  Terence Eden Feb 27 at 13:41
    
If I run sudo mount /home/edent/Dropbox/foo/ /var/www/foo --bind --ro everything works - but placing the above in fstab still causes an error.... –  Terence Eden Feb 28 at 8:41
    
Just to check, did you type /var/www/Foo in /etc/fstab instead of /var/www/foo, i.e. check case? –  alex hutter Feb 28 at 13:19

That is because your /home attributes are

 drwx------   67 edent edent      20480 Feb 27 09:11 ..

no x for group or other, so

cd /home/.... will fail

But when already in edent's home dir,

cd ./Dropbox/...

would work, because you do not use /home

edit 1

chmod o+x /home will allow the cd to work.

Here's the Apache documentation to set up a Directory Alias

share|improve this answer
    
Ok, so what command do I need to run in order to give www-data access? –  Terence Eden Feb 27 at 12:46
    
Am thinking about the best way to expose directory tree to webserver and think answer depends on your security risks. Is it a private webserver or exposed on internet ? How have you configured your webserver ? Is there a directory alias ? symbolic link to your dropbox dir ? is path exposed in the url ? This may be more a webserver question that Unix ... But more info required definitely. Could someone give us some advice on this please ? Start a new Question ? –  X Tian Feb 27 at 13:10
    
It's a private server on my LAN. I'll be opening up port 80 on my domestic connection so I can access it externally. –  Terence Eden Feb 27 at 13:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.