0

Working on Ubuntu 16.04.2 LTS as a LAMP stack.

I've setup a web project (Magento) that has pre-defined factory octal permissions throughout its codebase. I need to provide access to other developers. The project's location is /var/www/webproject and that is owned by the Apache owner/group www-data.

So I've created a user for the developer who belongs to group www-data (i.e. devuser) and given them SSH access. Currently, without using sudo, the user is unable to create or edit files contained within /var/www/webproject because the octal permissions do not allow for it.

Summary:

/var/www/webproject permissions = 750
Files & directories within /var/www/webproject vary but...
user:group assignment for everything = www-data:www-data

Question: In order for my user devuser to be able to correctly modify files and directories contained within /var/www/webproject, is it simply a matter of recursively applying the correct group permissions to ALL files and directories contained therein? Or is there a better approach that potentially preserves the web platform's (Magento) factory permissions but still allow any user within group www-data to modify files and directories?

0

There is no way to allow a group to sudolessly edit files that they don't have permissions to write to.

The user and the group called www-data are not the same (every user has a group with their username that contains only themselves, which is why there is a group called www-data. If you add other people to this group, they will have the group's permissions, not the user's permissions).

You must apply chmod g+w to files that group www-data should have write access to. It is generally safe to have your files in your web directory 770.

0

If you want to preserve the same effective permissions for the folder, it can be done with POSIX Access Control Lists:

sudo su -
chown -R :web_developers /var/www/webproject
chmod -R 2770 /var/www/webproject

setfacl -R -m u:www-data:rwx /var/www/webproject
setfacl -R -m d:u:www-data:rwx /var/www/webproject

setfacl -R -m g:www-data:r-x /var/www/webproject
setfacl -R -m d:g:www-data:r-x /var/www/webproject

setfacl -R -m o:0 /var/www/webproject
setfacl -R -m d:o:0 /var/www/webproject

Remove your web developer from www-data, he is not a web server. People should always belong to groups corresponding to the job(s) they do, then have the groups granted appropriate permissions. As such, he is one of your web_developers.

The end result:

  1. www-data will always have user permissions of rwx and group permissions of r-x for existing files and ones created in the future, mimicking the original 750
  2. Any member of the group web_developers will have full rwx access to all current files and those created in the future
  3. No one else has any permissions (other than root - and by extension group sudo)

The other shoe:

  • Files created by users in the group web_developers will be owned by them (although www-data will still have user rwx and group r-x permissions)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.