Giving write permissions to www-data for a file within user's home with limited shell access?

Question

I have an access to a remote server with ssh, but the access is limited: my account there, say UseR, can create files in /tmp and in its home directory, but not elsewhere; it can call chmod without sudo on own files, but cannot call chown.

In this context, I first wanted to give to Apache's www-data user permissions to create files in a subdirectory of UseR's home folder; but no matter what I did, I couldn't - I always got "permission denied". Then, I thought maybe I could just give permissions to a file, so www-data can write to it without creating it - I made the below script permtest.sh to test this concept, and run it via ssh as UseR, and from a php script so it runs as www-data; and obtained some logs.

This is the breakdown of involved path elements:

755 drwxr-xr-x 27 root root 4096 Apr 28 11:51 /
1777 drwxrwxrwt 7 root root 4096 May 25 11:22 /tmp
755  drwxr-xr-x 9 root root 4096 Oct 25  2013 /home
755  drwxr-xr-x 9 root root 4096 Apr 29 12:49 /home/users
755  drwxr-xr-x+ 12 no root 4096 Apr 30 17:07 /home/users/GROUP
775  drwxrwxr-x+ 47 UseR group_users 4096 Jun 21 11:20 /home/users/GROUP/UseR
777  drwxrwxrwx+ 3 UseR group_users 4096 Jun 21 11:22 /home/users/GROUP/UseR/tmp

I run permtest.sh 1 first as UseR then as www-data which initiates files in /tmp and /home/users/GROUP/UseR/tmp, then run permtest.sh 2 first as www-data then as UseR, which tries to append to files; and finally run permtest.sh 3 as UseR to print out the files, whose result is:

+ cat /tmp/MYtest_UseR.txt
testing write
testing write again
test www-data append
test UseR append
+ cat /home/users/GROUP/UseR/tmp/MYtest_UseR.txt
testing write
testing write again
test UseR append
+ cat /tmp/MYtest_www-data.txt
testing write
testing write again
test www-data append
test UseR append
+ cat /home/users/GROUP/UseR/tmp/MYtest_www-data.txt
test UseR append

So, the things is this: in /tmp, both UseR and www-data can create a file with 777 permissions upon instantiation, to which the other user can append subsequently. But that seems impossible to do in the home folder subdirectory /home/users/GROUP/UseR/tmp; if ran as www-data, regardless of whether trying to append to /home/users/GROUP/UseR/tmp/MYtest_UseR.txt owned by UseR, or trying to create /home/users/GROUP/UseR/tmp/MYtest_UseR.txt - the command fails with cannot create ... Permission denied. Note, this happens with the containing folder /home/users/GROUP/UseR/tmp having 777 permissions.

So my questions are these:

• Is there anything in the above information, that would tell me apriori that www-data will not be able to create a file in the user folder /home/users/GROUP/UseR/tmp? If not, how could I in principle obtain this information (apart from running the script below)?
• What options do I have, as a limited user, to allow write permissions for a file in /home/users/GROUP/UseR/tmp to www-data, such that it can modify/append data?

permtest.sh:

#!/bin/sh

STAGENUM=${1}
MESELF=$(whoami)
if [ "$STAGENUM" = "" ] ; then
  STAGENUM=1
fi

if [ "$STAGENUM" = "1" ] ; then
  for ix in /tmp /home /home/users /home/users/GROUP /home/users/GROUP/UseR /home/users/GROUP/UseR/tmp ; do
    printf '%s ' `stat -c "%a " ${ix} 2>&1`
    ls -lad ${ix} 2>&1
  done

  set -x
  for ix in /tmp /home/users/GROUP/UseR/tmp ; do
    touch ${ix}/MYtest_${MESELF}.txt 2>&1
    chmod 777 ${ix}/MYtest_${MESELF}.txt 2>&1
    ls -la ${ix}/MYtest_${MESELF}.txt 2>&1
    echo "testing write" > ${ix}/MYtest_${MESELF}.txt 2>&1
    echo "testing write again" | tee -a ${ix}/MYtest_${MESELF}.txt 2>&1
    cat ${ix}/MYtest_${MESELF}.txt 2>&1
    echo rm ${ix}/MYtest_${MESELF}.txt 2>&1 # don't remove now
  done
fi

if [ "$STAGENUM" = "2" ] ; then
  set -x
  echo "test $MESELF append" >> '/tmp/MYtest_UseR.txt' 2>&1
  echo "test $MESELF append" >> '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
  echo "test $MESELF append" >> '/tmp/MYtest_www-data.txt' 2>&1
  echo "test $MESELF append" >> '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
  set +x
  ls -la '/tmp/MYtest_UseR.txt' 2>&1
  ls -la '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
  ls -la '/tmp/MYtest_www-data.txt' 2>&1
  ls -la '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
fi

if [ "$STAGENUM" = "3" ] ; then
  set -x
  cat '/tmp/MYtest_UseR.txt' 2>&1
  cat '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
  cat '/tmp/MYtest_www-data.txt' 2>&1
  cat '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
  set +x
fi

if [ "$STAGENUM" = "4" ] ; then
  rm '/tmp/MYtest_UseR.txt' 2>&1 ;
  rm '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1 ;
  rm '/tmp/MYtest_www-data.txt' 2>&1 ;
  rm '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
fi

Answer 1

Your ls output shows with a + sign in the modes that your files and directories are using ACLs.

drwxr-xr-x+ ...

These may be restricting your accesses. List the acl permissions with

getfacl <file or directory>

and remove them with

setfacl -b <file or directory>

then check again.

---

EDIT from OP: Indeed, that is it - here is a snippet of what I did in the ssh shell (first copying permissions from elsewhere on one file, then giving extra permissions to www-data on the other file) - and afterwards www-data could append fine to these files:

UseR:~/tmp$ getfacl MYtest_www-data.txt
# file: MYtest_www-data.txt
# owner: UseR
# group: group_users
user::rw-
user:www-data:r-x       #effective:r--
group::r-x          #effective:r--
group:www-data:r-x      #effective:r--
mask::r--
other::r--

UseR:~/tmp$ getfacl /tmp/MYtest_www-data.txt
getfacl: Removing leading '/' from absolute path names
# file: tmp/MYtest_www-data.txt
# owner: www-data
# group: www-data
user::rwx
group::rwx
other::rwx

UseR:~/tmp$ getfacl /tmp/MYtest_www-data.txt | setfacl --set-file=- MYtest_www-data.txt
getfacl: Removing leading '/' from absolute path names
UseR:~/tmp$ getfacl MYtest_www-data.txt
# file: MYtest_www-data.txt
# owner: UseR
# group: group_users
user::rwx
group::rwx
other::rwx

UseR:~/tmp$ ls -la MYtest_www-data.txt
-rwxrwxrwx 1 UseR group_users 22 Jun 21 12:44 MYtest_www-data.txt

$ getfacl MYtest_UseR.txt
# file: MYtest_UseR.txt
# owner: UseR
# group: group_users
user::rwx
user:www-data:r-x
group::r-x
group:www-data:r-x
mask::rwx
other::rwx

UseR:~/tmp$ setfacl -m u:www-data:w MYtest_UseR.txt
UseR:~/tmp$ getfacl MYtest_UseR.txt
# file: MYtest_UseR.txt
# owner: UseR
# group: group_users
user::rwx
user:www-data:-w-
group::r-x
group:www-data:r-x
mask::rwx
other::rwx

UseR:~/tmp$ setfacl -m u:www-data:rw MYtest_UseR.txt
UseR:~/tmp$ getfacl MYtest_UseR.txt
# file: MYtest_UseR.txt
# owner: UseR
# group: group_users
user::rwx
user:www-data:rw-
group::r-x
group:www-data:r-x
mask::rwx
other::rwx