1

We have group Apache and, let's say, "District" group.

All our team members are part of "District" group.

Apache user is part of "Apache" group, and does a lot of work on our server, creating and modifying files. But "Apache" group has fairly strict permissions, so there is no way we "District" group members can write to these files.

How can we help "District" members have write permissions to these files? One way to solve it is to "chmod 777" everything in the Apache group...but...eh. We don't want the anyone to be able to edit these files...just people from "District" group.

Question: Is it possible to make "Apache" user remain in "Apache" group, but write as part of "District" group? (and, therefore, have all Apache-authored files become accessible to "District" members)

  • 3
    Use ACL linuxconfig.org/how-to-manage-acls-on-linux – Panther Oct 25 '18 at 16:44
  • As Christopher says, ACLs are probably what you are looking for. You could set a default ACL on the webroot with write permission for the District group, without changing the octal permissions and the user/group Apache is in – Bruno9779 Oct 25 '18 at 17:01
  • Thanks, I added a tag for OS (RHEL). I'm honestly a pretty new Linux user, I hadn't heard of ACLs before, I'll check them out! – Joe Schmo Oct 25 '18 at 17:18
  • Simpler than ACLs is the setgid bit on a directory - it forces all new files/subdirs created to be owned by the group that you did the setgid with on the upper level directory. – ivanivan Oct 25 '18 at 17:55