Context: I am creating a gitolite3 hook for a specific repo, which contains some logic and css foo of my website.

so what essentailly happens is

Content under /var/www/nginx/ looks like:

drwxrwxr-x. nginx   git   system_u:object_r:httpd_sys_content_t:s0 foo

.git is special:

drwxrwxr-x. git     git   system_u:object_r:httpd_sys_content_t:s0 .git

To make sure all subdirs have the proper access rights I used:

chown nginx:git -Rf ./webfoo
chmod g+rw -Rf ./webfoo
chown git:git -Rf ./webfoo/.git

[This is just bonus, you can skip this.]

The gitolite3 hook

cd /var/www/nginx/webfoo || exit
unset GIT_DIR
echo "where: $(pwd)"
git pull -f origin deploy-me-branch

remote: where: /var/www/nginx/webfoo
remote: From /home/gitolite/repositories/webfoo
remote:    c092ee2..07274a6  master     -> origin/master
remote: error: unable to unlink old '.gitignore' (Permission denied)
remote: error: unable to unlink old 'templates/fancypost.html' (Permission denied)
remote: error: unable to unlink old 'templates/layout.html' (Permission denied)

/var/log/audit/audit.log does not contain any access denies.

Update: Even loging in git locally does not work either. So this is probably unrelated to SELinux/file security context.

Why does this fail to work as I'd expect?

  • I suppose you've already done a setenforce 0 to verify it actually is SELinux blocking the operation and not something else? Also where does that error output in the page (after your hook script) come from?
    – Bratchley
    May 5 '14 at 18:21
  • Just tried that to ensure, no change (as I expected, since /var/log/audit/audit.log contains nothing). So it is not selinux related but I have no clue what it acutlly is...
    – drahnr
    May 5 '14 at 18:43

A few reasons why it did not work:

  • user git should be member of group git
  • do not pull/rebase as a different user, the .git/* might change ownership, this is especially when being logged in as root

A more elegant solution is to use monit, monitoring the repository under (as user git) ~/repositories so I can also restart nginx and uwsgi if a executable webapp/file changed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.