allow user access via ssh to /var/www/

Question

Context: I am creating a gitolite3 hook for a specific repo, which contains some logic and css foo of my website.

so what essentailly happens is

Content under /var/www/nginx/ looks like:

drwxrwxr-x. nginx   git   system_u:object_r:httpd_sys_content_t:s0 foo

.git is special:

drwxrwxr-x. git     git   system_u:object_r:httpd_sys_content_t:s0 .git

To make sure all subdirs have the proper access rights I used:

chown nginx:git -Rf ./webfoo
chmod g+rw -Rf ./webfoo
chown git:git -Rf ./webfoo/.git

---

[This is just bonus, you can skip this.]

The gitolite3 hook

#!/bin/bash
cd /var/www/nginx/webfoo || exit
unset GIT_DIR
echo "where: $(pwd)"
git pull -f origin deploy-me-branch

---

remote: where: /var/www/nginx/webfoo
remote: From /home/gitolite/repositories/webfoo
remote:    c092ee2..07274a6  master     -> origin/master
remote: error: unable to unlink old '.gitignore' (Permission denied)
remote: error: unable to unlink old 'templates/fancypost.html' (Permission denied)
remote: error: unable to unlink old 'templates/layout.html' (Permission denied)

---

/var/log/audit/audit.log does not contain any access denies.

---

Update: Even loging in git locally does not work either. So this is probably unrelated to SELinux/file security context.

---

Why does this fail to work as I'd expect?

Answer 1

A few reasons why it did not work:

• user git should be member of group git
• do not pull/rebase as a different user, the .git/* might change ownership, this is especially when being logged in as root

---

A more elegant solution is to use monit, monitoring the repository under (as user git) ~/repositories so I can also restart nginx and uwsgi if a executable webapp/file changed.