Correct way to provision user so that any file/directory associated with their group is editable

Question

Working on Ubuntu 16.04.2 LTS as a LAMP stack.

I've setup a web project (Magento) that has pre-defined factory octal permissions throughout its codebase. I need to provide access to other developers. The project's location is /var/www/webproject and that is owned by the Apache owner/group www-data.

So I've created a user for the developer who belongs to group www-data (i.e. devuser) and given them SSH access. Currently, without using sudo, the user is unable to create or edit files contained within /var/www/webproject because the octal permissions do not allow for it.

Summary:

/var/www/webproject permissions = 750
Files & directories within /var/www/webproject vary but...
user:group assignment for everything = www-data:www-data

Question: In order for my user devuser to be able to correctly modify files and directories contained within /var/www/webproject, is it simply a matter of recursively applying the correct group permissions to ALL files and directories contained therein? Or is there a better approach that potentially preserves the web platform's (Magento) factory permissions but still allow any user within group www-data to modify files and directories?

Answer 1

There is no way to allow a group to sudolessly edit files that they don't have permissions to write to.

The user and the group called www-data are not the same (every user has a group with their username that contains only themselves, which is why there is a group called www-data. If you add other people to this group, they will have the group's permissions, not the user's permissions).

You must apply chmod g+w to files that group www-data should have write access to. It is generally safe to have your files in your web directory 770.

Answer 2

If you want to preserve the same effective permissions for the folder, it can be done with POSIX Access Control Lists:

sudo su -
chown -R :web_developers /var/www/webproject
chmod -R 2770 /var/www/webproject

setfacl -R -m u:www-data:rwx /var/www/webproject
setfacl -R -m d:u:www-data:rwx /var/www/webproject

setfacl -R -m g:www-data:r-x /var/www/webproject
setfacl -R -m d:g:www-data:r-x /var/www/webproject

setfacl -R -m o:0 /var/www/webproject
setfacl -R -m d:o:0 /var/www/webproject

Remove your web developer from www-data, he is not a web server. People should always belong to groups corresponding to the job(s) they do, then have the groups granted appropriate permissions. As such, he is one of your web_developers.

The end result:

1. www-data will always have user permissions of rwx and group permissions of r-x for existing files and ones created in the future, mimicking the original 750
2. Any member of the group web_developers will have full rwx access to all current files and those created in the future
3. No one else has any permissions (other than root - and by extension group sudo)

The other shoe:

• Files created by users in the group web_developers will be owned by them (although www-data will still have user rwx and group r-x permissions)