3

I have mounted a remote share via my fstab using the line:

//path/to/target /media/f cifs gid=<mygroup's id>,dir_mode=0775,file_mode=0775 0 0

As a result, everything under /media/f winds up with permissions that look like this:

$ ls -al
drwxrwxr-x 0 root mygroup ...

I have made the user www-data a member of mygroup, with the goal of allowing a Django webapp to write files within /media/f. However, it doesn't work. I get permission errors.

In an effort to fix the problem, I changed the mount line to set both the gid and uid so that the mount point has user www-data and group mygroup. So now my mount point looks like this:

$ ls -al
drwxrwxr-x 0 www-data mygroup ...

And everything works fine.

The question: why is it that my webapp is able to write to /media/f when the that folder is owned by www-data:mygroup but not when it is owned by root:mygroup (knowing that www-data is a member of mygroup?

I have tried remounting as well as restarting in the hopes of getting the membership of www-data (the user) to the group mygroup to "stick" but it just doesn't work.

Oddly, when set up with the root:mygroup ownership, if I sudo su www-data and then try to write to /media/f from the terminal, everything works fine. Any idea what's going on there? It's as if the uwsgi process that's running django isn't really running with the full permissions I've tried to grant to www-data.

Thoughts?

2

It turns out this was quite specific to the context described above. I was using uWSGI to serve my site using emperor mode. I set the parameters uid=www-data and gid=www-data. I expected this to cause my vassal processes to have the permissions associated with the user and the group www-data as well as the permissions associated with any group to which www-data (the user) belongs. This assumption is incorrect. Vassals do not run (by default) with any supplementary group ids.

It turns out uWSGI (in recent versions) has a fix for this. You can manually specify add-gid=mygroup in the uWSGI configuration. You can specify this parameter many times to add as many gid's to a vassal process as your heart desires. This feature is only available as of uWSGI 1.9.15 so you might need to upgrade to use this approach.

Full writeup here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.