I have been tasked to set up a new server for our web project hosting. I'm a developer, so my systems administration level is quite low.
I have come up with a somewhat simple solution that each project will have it's own UNIX user and that the webroot will be under user's
The structure is as simple as:
/home/<user>/web/log— log files.
/home/<user>/web/www— web document root.
/home/<user>/web/www/public— just a practice that has come up with various web application frameworks to separate document root from public root.
Now, I want to set permissions in such a way that:
/home/<user>/web— can neither be deleted, nor new files/directories added.
chown root:roothelps here.
/home/<user>/web/log— is read only to the user, which I can also manage by a simple
/home/<user>/web/www— this shouldn't be possible to delete/edit, but contents freely modifiable (except
public). Create, delete, edit both files and directories.
/home/<user>/web/www/public— shouldn't be possible to delete/edit, but contents freely modifiable.
For other security and isolation related features, I have opted to use firejail.
So far I have tried
chattr +a - it allowed me to add new contents, edit contents, but I couldn't delete them.
While writing the question, similar question section showed Prevent a subdirectory from getting deleted / enforce a directory structure, which works and I am looking to use it for now.
But are there any other, more transparent ways of setting these directories up as such?