3

I have set up a webserver daemon on a VPS. This daemon is run by its own service user, named "node". I have already assigned node's home directory a "siteadmin" owning group that I am in, set chmod g+s and done the setfacl things necessary to allow me to act on the files it uses within its home directory.

Commands are passed to the running daemon by calling another instance of this program with specific options set. Involved in this process is access to a /tmp/unix.socket file created by the running daemon with user node, group node, and permissions 755. In order for this process to succeed, I must change the owning group of this file to siteadmin and grant write permission on the file to the group. However, whenever the daemon starts, it deletes and recreates this file, leaving me back where I started.

This is a minor hassle, easily solved by running a two-line shell script whenever I want to pass commands to the daemon, but I'm interested in a more eloquent solution, if one exists.

Would it be possible to automate changing the owning group and permissions of this file, whenever it is created? Would it be possible to automatically set a given group and group permissions for any file created by the user node, anywhere within the file system?

  • Can't you configure the daemon to create the socket in a different directory and with umask 002 or 007? Even if you can't change the umask, most sensible ways to do what you want would require the socket to be in a directory under your control rather than /tmp. What software is the daemon? – Gilles Mar 31 '17 at 23:39
  • Open-source imageboard software LynxChan. Talking with the developer on irc for awhile, it finally came out that the location the socket is placed is, in fact, configurable by a setting, so not a big deal. Then, ironically, I run into the same situation this guy had, where the permissions on the socket aren't set as specified by setfacl -d. I'm using CentOS 7 as well. Maybe a bug? – senseless Apr 1 '17 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.