Nginx requires identical permissions for a whole path up to a directory “assets” of my app to be able to read and serve assets

Question

I have a web app in the folder:

  /home/main_user/dir1/dir2/my_web_app/

In there I have an executable file and the folder assets.

Nginx is setup this way - to serve assets only:

  location ~ ^/assets/(images|css|js| [.........])/(.*) {
    alias /home/main_user/dir1/dir2/my_web_app/assets/$1/$2;
    autoindex off;
  }

Nginx is running under user "http"

It turns out that nginx has permission denied error for the "assets" folder. Even when I changed the owner of directory "assets" to be "http" and gave it 755

To fix the error I'll have to give permissions "o+x" all the way from the root up to the folder "assets". Not merely to the folder "assets"

Namely, I'll have to call "o+x" for:

   /home
   /home/main_user/
   /home/main_user/dir1/

etc.....

This seems wrong to me, at least because everyone would be permitted to execute any file in /home/main_user. But doing that only for the directory "assets" doesn't work.

Is there a better and, more over, recommended way?

Answer 1

On a directory's permissions, the execute bit actually means "allow access to files and directories contained within this one" (while the read bit allows one to list the contents of the directory). So you are correct that the http user will need at least x permission along the entire chain of directories.

That said, you don't have to grant this access to all users. With ACLs, you can allow access just for the http user. See setfacl(1) for full details, but setfacl -m u:http:x /home (and the other intervening directories) should get you started.

An alternative way to grant access to a single user is to set the owning group of the files to one that contains all and only those users that should be able to access them and set group permissions accordingly. One issue with this approach is that, in general, it can result in the creation of a huge number of groups. Another is that this approach is incompatible with, say, a file writable by two people, readable by some group, and inaccessible by others. That is why we use ACLs.