2

I have a server running Tomcat, and I need Tomcat to create a file in a particular folder.

Tomcat (technically a Java app) runs as the user 'tomcat', as evidenced by top:

#top
1251 tomcat    20   0 7427m 2.3g 9624 S  3.0 30.0 856:04.62 java

Part of my Tomcat code is to create a new file 'foo.txt' in '/foo/'

The user 'tomcat' is a member of group 'work', as evidenced by groups:

#groups tomcat
tomcat : tomcat work

The folder '/foo/' has these permissions:

drwxrwxr-x   2 root work 4096 Oct  8 14:20 .

When Tomcat tries to create a file within that folder, he gets a 'permission denied' error.

HOWEVER, when I chown /foo/ to the tomcat user, it works fine.

SO, is Java somehow not able to utilize Group permissions?? Not likely, IMHO. What am I missing?

| improve this question | |
  • How are you starting tomcat? It sounds like it's not calling initgroups(), so the process doesn't get all its secondary groups enabled. – Barmar Oct 8 '14 at 19:42
  • 2
    Also what's the distro? Contexts on the directory /foo may be blocking Tomcat from writing to this directory via SELinux. You can run sealert to see any pending alerts. – slm♦ Oct 8 '14 at 20:06
  • @slm - Selinux context causes the 'ls -l' command to show '.' sign at the end of the permission column. If Jon pasted real 'ls -l' output it looks like there isn't any selinux on this system. However if there isn't a selinux and the '/foo' directory realy lies at the / directory, I suggest to restart tomcat because it's possible the tomcat is not able to see a new group added when it was already started. – Sebastian Piech Oct 8 '14 at 21:33
  • You did restart tomcat after adding tomcat to the "work" group? – wurtel Oct 9 '14 at 8:14
  • @SebastianPiech - good point, I hadn't noticed the output was missing the dot denoting context at the end of the permissions bits. Though the lack of any contexts being applied to this directory may be the issue if SELinux is involved. It's still worth a look, IMO. – slm♦ Oct 9 '14 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.