You are explaining bindfs. What you want to do can't be done with anything substantially simpler. Symbolic links have no impact on permissions, they won't solve your problem.
The assertion that “it's horrible for scale-ability” doesn't rest on any fact that I can think of. Bindfs is pretty easy to use — just call the bindfs
command to create a filesystem view, and call fusermount -u
when you're tired of that view. If there's something you can't figure out, feel free to ask a question here.
However, bindfs may not be what you need, because the requirement you gave is not a good idea in most scenarios. It is usually a bad idea to have a file that is both owned by www-data
, i.e. meant to be managed by a web application, and accessed directly by other users. If the file needs to be read by the application and managed by other users, then what you need is to set an ACL that allows the www-data
user to read the files. See Why don't I have read access to files with modified ACL?
If what you need is for developers to be able to modify a website, then the developers should never touch files in production, you should have a deployment system instead.
www-data
group. Option 2 add all user groups to www-data. Option 3 create a new group that is added www-data user and to each user.setfacl
of packageacl
for this rule.