Context: I am creating a gitolite3 hook for a specific repo, which contains some logic and css foo of my website.

so what essentailly happens is

Content under /var/www/nginx/ looks like:

drwxrwxr-x. nginx   git   system_u:object_r:httpd_sys_content_t:s0 foo

.git is special:

drwxrwxr-x. git     git   system_u:object_r:httpd_sys_content_t:s0 .git

To make sure all subdirs have the proper access rights I used:

chown nginx:git -Rf ./webfoo
chmod g+rw -Rf ./webfoo
chown git:git -Rf ./webfoo/.git

[This is just bonus, you can skip this.]

The gitolite3 hook

cd /var/www/nginx/webfoo || exit
unset GIT_DIR
echo "where: $(pwd)"
git pull -f origin deploy-me-branch

remote: where: /var/www/nginx/webfoo
remote: From /home/gitolite/repositories/webfoo
remote:    c092ee2..07274a6  master     -> origin/master
remote: error: unable to unlink old '.gitignore' (Permission denied)
remote: error: unable to unlink old 'templates/fancypost.html' (Permission denied)
remote: error: unable to unlink old 'templates/layout.html' (Permission denied)

/var/log/audit/audit.log does not contain any access denies.

Update: Even loging in git locally does not work either. So this is probably unrelated to SELinux/file security context.

Why does this fail to work as I'd expect?

  • I suppose you've already done a setenforce 0 to verify it actually is SELinux blocking the operation and not something else? Also where does that error output in the page (after your hook script) come from?
    – Bratchley
    May 5, 2014 at 18:21
  • Just tried that to ensure, no change (as I expected, since /var/log/audit/audit.log contains nothing). So it is not selinux related but I have no clue what it acutlly is...
    – drahnr
    May 5, 2014 at 18:43

1 Answer 1


A few reasons why it did not work:

  • user git should be member of group git
  • do not pull/rebase as a different user, the .git/* might change ownership, this is especially when being logged in as root

A more elegant solution is to use monit, monitoring the repository under (as user git) ~/repositories so I can also restart nginx and uwsgi if a executable webapp/file changed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .