3

I try to set up a deployer user for CI with Teamcity. I followed the instructions from this question on ServerFault: What's the best way of handling permissions for apache2's user www-data in /var/www?

The problem is that the Teamcity application is creating directories with 755 permissions and the apache(2.4) can't write in some of them. If I change the permissions to 775 manually, apache can write them.

Here's what I did to set uo the permissions:

  1. I created a user teamcity.
  2. Added www-data group to the user as secondary group
  3. Changed the ownership of /var/www to root:www-data

  4. Changed permissions for directories with:

    find /var/www -type d -exec chmod 2775 {} +

    and for files with:

    find /var/www -type f -exec chmod 0664 {} +

  5. Added umask 0002 to /etc/profile

Tested:

su teamcity
umask 
>0002
touch testfile
ls -l
>-rw-rw-r-- 1 teamcity teamcity        0 May 25 10:38 testfile
cd /var/www
touch testfile
ls -l
>-rw-rw-r--  1 teamcity www-data      0 Mai 25 10:42 testfile

For directories its the same. They are rw for user and group.

After a deployment the permissions of directories and files are 755 and not 775 as expected.

The Teamcity application is started as a service:

start-stop-daemon --start -c teamcity --exec /opt/TeamCity/bin/runAll.sh start

It seems that I missed some detail, but can't find it.

System:

  • Debian jessie
  • Apache 2.4
  • Teamcity 9

Solution:

I changed the startup script for the Teamcity service by adding umask 002 before the startup command.

2
  • You mean to say that apache cannot write in those directories.
    – Thomas Dickey
    May 25, 2016 at 9:03
  • @ThomasDickey Yes, because after the deployment the permissions are set to 755 instead of 775.
    – twenty7
    May 25, 2016 at 9:12

1 Answer 1

Reset to default
0

From the description, it seems that TeamCity is ignoring the umask. Perhaps it sets the umask in its service script (which was not mentioned in the question). If so, you could modify the script. If not, since it's apparently a closed-source application and in Java, your ability to thwart that is limited. You could make a cron job (running once per minute) which fixes the directory permissions.

Further reading:

1
  • Your links pointed me in the right direction. I changed the startup script for the Teamcity service by adding umask 002 before the startup command.
    – twenty7
    May 26, 2016 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .