2

I have a server running Tomcat, and I need Tomcat to create a file in a particular folder.

Tomcat (technically a Java app) runs as the user 'tomcat', as evidenced by top:

#top
1251 tomcat    20   0 7427m 2.3g 9624 S  3.0 30.0 856:04.62 java

Part of my Tomcat code is to create a new file 'foo.txt' in '/foo/'

The user 'tomcat' is a member of group 'work', as evidenced by groups:

#groups tomcat
tomcat : tomcat work

The folder '/foo/' has these permissions:

drwxrwxr-x   2 root work 4096 Oct  8 14:20 .

When Tomcat tries to create a file within that folder, he gets a 'permission denied' error.

HOWEVER, when I chown /foo/ to the tomcat user, it works fine.

SO, is Java somehow not able to utilize Group permissions?? Not likely, IMHO. What am I missing?

Improve this question
6
  • How are you starting tomcat? It sounds like it's not calling initgroups(), so the process doesn't get all its secondary groups enabled.
    – Barmar
    Oct 8, 2014 at 19:42
  • 2
    Also what's the distro? Contexts on the directory /foo may be blocking Tomcat from writing to this directory via SELinux. You can run sealert to see any pending alerts.
    – slm ♦
    Oct 8, 2014 at 20:06
  • @slm - Selinux context causes the 'ls -l' command to show '.' sign at the end of the permission column. If Jon pasted real 'ls -l' output it looks like there isn't any selinux on this system. However if there isn't a selinux and the '/foo' directory realy lies at the / directory, I suggest to restart tomcat because it's possible the tomcat is not able to see a new group added when it was already started.
    – Sebastian Piech
    Oct 8, 2014 at 21:33
  • You did restart tomcat after adding tomcat to the "work" group?
    – wurtel
    Oct 9, 2014 at 8:14
  • @SebastianPiech - good point, I hadn't noticed the output was missing the dot denoting context at the end of the permissions bits. Though the lack of any contexts being applied to this directory may be the issue if SELinux is involved. It's still worth a look, IMO.
    – slm ♦
    Oct 9, 2014 at 13:11

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.