0

I have an access to a remote server with ssh, but the access is limited: my account there, say UseR, can create files in /tmp and in its home directory, but not elsewhere; it can call chmod without sudo on own files, but cannot call chown.

In this context, I first wanted to give to Apache's www-data user permissions to create files in a subdirectory of UseR's home folder; but no matter what I did, I couldn't - I always got "permission denied". Then, I thought maybe I could just give permissions to a file, so www-data can write to it without creating it - I made the below script permtest.sh to test this concept, and run it via ssh as UseR, and from a php script so it runs as www-data; and obtained some logs.

This is the breakdown of involved path elements:

755 drwxr-xr-x 27 root root 4096 Apr 28 11:51 /
1777 drwxrwxrwt 7 root root 4096 May 25 11:22 /tmp
755  drwxr-xr-x 9 root root 4096 Oct 25  2013 /home
755  drwxr-xr-x 9 root root 4096 Apr 29 12:49 /home/users
755  drwxr-xr-x+ 12 no root 4096 Apr 30 17:07 /home/users/GROUP
775  drwxrwxr-x+ 47 UseR group_users 4096 Jun 21 11:20 /home/users/GROUP/UseR
777  drwxrwxrwx+ 3 UseR group_users 4096 Jun 21 11:22 /home/users/GROUP/UseR/tmp

I run permtest.sh 1 first as UseR then as www-data which initiates files in /tmp and /home/users/GROUP/UseR/tmp, then run permtest.sh 2 first as www-data then as UseR, which tries to append to files; and finally run permtest.sh 3 as UseR to print out the files, whose result is:

+ cat /tmp/MYtest_UseR.txt
testing write
testing write again
test www-data append
test UseR append
+ cat /home/users/GROUP/UseR/tmp/MYtest_UseR.txt
testing write
testing write again
test UseR append
+ cat /tmp/MYtest_www-data.txt
testing write
testing write again
test www-data append
test UseR append
+ cat /home/users/GROUP/UseR/tmp/MYtest_www-data.txt
test UseR append

So, the things is this: in /tmp, both UseR and www-data can create a file with 777 permissions upon instantiation, to which the other user can append subsequently. But that seems impossible to do in the home folder subdirectory /home/users/GROUP/UseR/tmp; if ran as www-data, regardless of whether trying to append to /home/users/GROUP/UseR/tmp/MYtest_UseR.txt owned by UseR, or trying to create /home/users/GROUP/UseR/tmp/MYtest_UseR.txt - the command fails with cannot create ... Permission denied. Note, this happens with the containing folder /home/users/GROUP/UseR/tmp having 777 permissions.

So my questions are these:

  • Is there anything in the above information, that would tell me apriori that www-data will not be able to create a file in the user folder /home/users/GROUP/UseR/tmp? If not, how could I in principle obtain this information (apart from running the script below)?
  • What options do I have, as a limited user, to allow write permissions for a file in /home/users/GROUP/UseR/tmp to www-data, such that it can modify/append data?

permtest.sh:

#!/bin/sh

STAGENUM=${1}
MESELF=$(whoami)
if [ "$STAGENUM" = "" ] ; then
  STAGENUM=1
fi

if [ "$STAGENUM" = "1" ] ; then
  for ix in /tmp /home /home/users /home/users/GROUP /home/users/GROUP/UseR /home/users/GROUP/UseR/tmp ; do
    printf '%s ' `stat -c "%a " ${ix} 2>&1`
    ls -lad ${ix} 2>&1
  done

  set -x
  for ix in /tmp /home/users/GROUP/UseR/tmp ; do
    touch ${ix}/MYtest_${MESELF}.txt 2>&1
    chmod 777 ${ix}/MYtest_${MESELF}.txt 2>&1
    ls -la ${ix}/MYtest_${MESELF}.txt 2>&1
    echo "testing write" > ${ix}/MYtest_${MESELF}.txt 2>&1
    echo "testing write again" | tee -a ${ix}/MYtest_${MESELF}.txt 2>&1
    cat ${ix}/MYtest_${MESELF}.txt 2>&1
    echo rm ${ix}/MYtest_${MESELF}.txt 2>&1 # don't remove now
  done
fi

if [ "$STAGENUM" = "2" ] ; then
  set -x
  echo "test $MESELF append" >> '/tmp/MYtest_UseR.txt' 2>&1
  echo "test $MESELF append" >> '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
  echo "test $MESELF append" >> '/tmp/MYtest_www-data.txt' 2>&1
  echo "test $MESELF append" >> '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
  set +x
  ls -la '/tmp/MYtest_UseR.txt' 2>&1
  ls -la '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
  ls -la '/tmp/MYtest_www-data.txt' 2>&1
  ls -la '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
fi

if [ "$STAGENUM" = "3" ] ; then
  set -x
  cat '/tmp/MYtest_UseR.txt' 2>&1
  cat '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
  cat '/tmp/MYtest_www-data.txt' 2>&1
  cat '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
  set +x
fi

if [ "$STAGENUM" = "4" ] ; then
  rm '/tmp/MYtest_UseR.txt' 2>&1 ;
  rm '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1 ;
  rm '/tmp/MYtest_www-data.txt' 2>&1 ;
  rm '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
fi
  • 1
    Could you give some background on what you are trying to do? E.g. why you want "to give to Apache's www-data user permissions to create files in a subdirectory of UseR's home folder". – Faheem Mitha Jun 21 '15 at 13:29
  • Thanks @FaheemMitha - trying to set up HTTP access to bare git repos in my home directory there, which works fine, except for push, because in that case git-http-backend runs as www-data, and fails to update the bare repos; cheers! – sdaau Jun 21 '15 at 17:45
  • 1
    There are standard ways of allowing web access to a git repos. And if not, checking it out in the space the web server is normally given read access to seems a more normal thing to do. – Faheem Mitha Jun 21 '15 at 18:34
1

Your ls output shows with a + sign in the modes that your files and directories are using ACLs.

drwxr-xr-x+ ...

These may be restricting your accesses. List the acl permissions with

getfacl <file or directory>

and remove them with

setfacl -b <file or directory>

then check again.


EDIT from OP: Indeed, that is it - here is a snippet of what I did in the ssh shell (first copying permissions from elsewhere on one file, then giving extra permissions to www-data on the other file) - and afterwards www-data could append fine to these files:

UseR:~/tmp$ getfacl MYtest_www-data.txt
# file: MYtest_www-data.txt
# owner: UseR
# group: group_users
user::rw-
user:www-data:r-x       #effective:r--
group::r-x          #effective:r--
group:www-data:r-x      #effective:r--
mask::r--
other::r--

UseR:~/tmp$ getfacl /tmp/MYtest_www-data.txt
getfacl: Removing leading '/' from absolute path names
# file: tmp/MYtest_www-data.txt
# owner: www-data
# group: www-data
user::rwx
group::rwx
other::rwx

UseR:~/tmp$ getfacl /tmp/MYtest_www-data.txt | setfacl --set-file=- MYtest_www-data.txt
getfacl: Removing leading '/' from absolute path names
UseR:~/tmp$ getfacl MYtest_www-data.txt
# file: MYtest_www-data.txt
# owner: UseR
# group: group_users
user::rwx
group::rwx
other::rwx

UseR:~/tmp$ ls -la MYtest_www-data.txt
-rwxrwxrwx 1 UseR group_users 22 Jun 21 12:44 MYtest_www-data.txt

$ getfacl MYtest_UseR.txt
# file: MYtest_UseR.txt
# owner: UseR
# group: group_users
user::rwx
user:www-data:r-x
group::r-x
group:www-data:r-x
mask::rwx
other::rwx

UseR:~/tmp$ setfacl -m u:www-data:w MYtest_UseR.txt
UseR:~/tmp$ getfacl MYtest_UseR.txt
# file: MYtest_UseR.txt
# owner: UseR
# group: group_users
user::rwx
user:www-data:-w-
group::r-x
group:www-data:r-x
mask::rwx
other::rwx

UseR:~/tmp$ setfacl -m u:www-data:rw MYtest_UseR.txt
UseR:~/tmp$ getfacl MYtest_UseR.txt
# file: MYtest_UseR.txt
# owner: UseR
# group: group_users
user::rwx
user:www-data:rw-
group::r-x
group:www-data:r-x
mask::rwx
other::rwx
  • Many thanks @meuh - indeed, that was it; edited your post with a snippet of server operations, hope it passes peer review; cheers! – sdaau Jun 21 '15 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.