0

I have a web app in the folder:

  /home/main_user/dir1/dir2/my_web_app/

In there I have an executable file and the folder assets.

Nginx is setup this way - to serve assets only:

  location ~ ^/assets/(images|css|js| [.........])/(.*) {
    alias /home/main_user/dir1/dir2/my_web_app/assets/$1/$2;
    autoindex off;
  }

Nginx is running under user "http"

It turns out that nginx has permission denied error for the "assets" folder. Even when I changed the owner of directory "assets" to be "http" and gave it 755

To fix the error I'll have to give permissions "o+x" all the way from the root up to the folder "assets". Not merely to the folder "assets"

Namely, I'll have to call "o+x" for:

   /home
   /home/main_user/
   /home/main_user/dir1/

etc.....

This seems wrong to me, at least because everyone would be permitted to execute any file in /home/main_user. But doing that only for the directory "assets" doesn't work.

Is there a better and, more over, recommended way?

  • @Fox post your answer – nylypej Dec 31 '18 at 3:53
1

On a directory's permissions, the execute bit actually means "allow access to files and directories contained within this one" (while the read bit allows one to list the contents of the directory). So you are correct that the http user will need at least x permission along the entire chain of directories.

That said, you don't have to grant this access to all users. With ACLs, you can allow access just for the http user. See setfacl(1) for full details, but setfacl -m u:http:x /home (and the other intervening directories) should get you started.

An alternative way to grant access to a single user is to set the owning group of the files to one that contains all and only those users that should be able to access them and set group permissions accordingly. One issue with this approach is that, in general, it can result in the creation of a huge number of groups. Another is that this approach is incompatible with, say, a file writable by two people, readable by some group, and inaccessible by others. That is why we use ACLs.

  • what do you mean by "should get you started"? – nylypej Dec 31 '18 at 10:53
  • It will be sufficient to avoid permission errors, but there are more advanced options (like default ACLs) that might make things more convenient later – Fox Dec 31 '18 at 19:57
  • Ok. Isn't there a way to archive the same thing via the standard commands such as chown, chmod.... ? – nylypej Dec 31 '18 at 20:48
  • actrually, setfacl -m u:http:x /home alone doesn't work -- error 403 still – nylypej Dec 31 '18 at 20:57
  • The "etc" was "and the rest of the directory chain". Sorry for not being clear about that. ACLs are "standard" as in "available everywhere" (though on macOS the functionality is part of chmod) – Fox Dec 31 '18 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.