I have an access to a remote server with ssh
, but the access is limited: my account there, say UseR
, can create files in /tmp
and in its home directory, but not elsewhere; it can call chmod
without sudo
on own files, but cannot call chown
.
In this context, I first wanted to give to Apache's www-data
user permissions to create files in a subdirectory of UseR
's home folder; but no matter what I did, I couldn't - I always got "permission denied". Then, I thought maybe I could just give permissions to a file, so www-data
can write to it without creating it - I made the below script permtest.sh
to test this concept, and run it via ssh as UseR
, and from a php script so it runs as www-data
; and obtained some logs.
This is the breakdown of involved path elements:
755 drwxr-xr-x 27 root root 4096 Apr 28 11:51 /
1777 drwxrwxrwt 7 root root 4096 May 25 11:22 /tmp
755 drwxr-xr-x 9 root root 4096 Oct 25 2013 /home
755 drwxr-xr-x 9 root root 4096 Apr 29 12:49 /home/users
755 drwxr-xr-x+ 12 no root 4096 Apr 30 17:07 /home/users/GROUP
775 drwxrwxr-x+ 47 UseR group_users 4096 Jun 21 11:20 /home/users/GROUP/UseR
777 drwxrwxrwx+ 3 UseR group_users 4096 Jun 21 11:22 /home/users/GROUP/UseR/tmp
I run permtest.sh 1
first as UseR
then as www-data
which initiates files in /tmp
and /home/users/GROUP/UseR/tmp
, then run permtest.sh 2
first as www-data
then as UseR
, which tries to append to files; and finally run permtest.sh 3
as UseR
to print out the files, whose result is:
+ cat /tmp/MYtest_UseR.txt
testing write
testing write again
test www-data append
test UseR append
+ cat /home/users/GROUP/UseR/tmp/MYtest_UseR.txt
testing write
testing write again
test UseR append
+ cat /tmp/MYtest_www-data.txt
testing write
testing write again
test www-data append
test UseR append
+ cat /home/users/GROUP/UseR/tmp/MYtest_www-data.txt
test UseR append
So, the things is this: in /tmp
, both UseR
and www-data
can create a file with 777 permissions upon instantiation, to which the other user can append subsequently. But that seems impossible to do in the home folder subdirectory /home/users/GROUP/UseR/tmp
; if ran as www-data
, regardless of whether trying to append to /home/users/GROUP/UseR/tmp/MYtest_UseR.txt
owned by UseR
, or trying to create /home/users/GROUP/UseR/tmp/MYtest_UseR.txt
- the command fails with cannot create ... Permission denied
. Note, this happens with the containing folder /home/users/GROUP/UseR/tmp
having 777 permissions.
So my questions are these:
- Is there anything in the above information, that would tell me apriori that
www-data
will not be able to create a file in the user folder/home/users/GROUP/UseR/tmp
? If not, how could I in principle obtain this information (apart from running the script below)? - What options do I have, as a limited user, to allow write permissions for a file in
/home/users/GROUP/UseR/tmp
towww-data
, such that it can modify/append data?
permtest.sh
:
#!/bin/sh
STAGENUM=${1}
MESELF=$(whoami)
if [ "$STAGENUM" = "" ] ; then
STAGENUM=1
fi
if [ "$STAGENUM" = "1" ] ; then
for ix in /tmp /home /home/users /home/users/GROUP /home/users/GROUP/UseR /home/users/GROUP/UseR/tmp ; do
printf '%s ' `stat -c "%a " ${ix} 2>&1`
ls -lad ${ix} 2>&1
done
set -x
for ix in /tmp /home/users/GROUP/UseR/tmp ; do
touch ${ix}/MYtest_${MESELF}.txt 2>&1
chmod 777 ${ix}/MYtest_${MESELF}.txt 2>&1
ls -la ${ix}/MYtest_${MESELF}.txt 2>&1
echo "testing write" > ${ix}/MYtest_${MESELF}.txt 2>&1
echo "testing write again" | tee -a ${ix}/MYtest_${MESELF}.txt 2>&1
cat ${ix}/MYtest_${MESELF}.txt 2>&1
echo rm ${ix}/MYtest_${MESELF}.txt 2>&1 # don't remove now
done
fi
if [ "$STAGENUM" = "2" ] ; then
set -x
echo "test $MESELF append" >> '/tmp/MYtest_UseR.txt' 2>&1
echo "test $MESELF append" >> '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
echo "test $MESELF append" >> '/tmp/MYtest_www-data.txt' 2>&1
echo "test $MESELF append" >> '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
set +x
ls -la '/tmp/MYtest_UseR.txt' 2>&1
ls -la '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
ls -la '/tmp/MYtest_www-data.txt' 2>&1
ls -la '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
fi
if [ "$STAGENUM" = "3" ] ; then
set -x
cat '/tmp/MYtest_UseR.txt' 2>&1
cat '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1
cat '/tmp/MYtest_www-data.txt' 2>&1
cat '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
set +x
fi
if [ "$STAGENUM" = "4" ] ; then
rm '/tmp/MYtest_UseR.txt' 2>&1 ;
rm '/home/users/GROUP/UseR/tmp/MYtest_UseR.txt' 2>&1 ;
rm '/tmp/MYtest_www-data.txt' 2>&1 ;
rm '/home/users/GROUP/UseR/tmp/MYtest_www-data.txt' 2>&1
fi
git
repos in my home directory there, which works fine, except for push, because in that casegit-http-backend
runs aswww-data
, and fails to update the bare repos; cheers!