FS permission scenario

Question

How can I achieve this files & folders permissions scenario:

Consider these folder:
Folder A: 640 root apache /var/www/A/
Folder www: 640 root apache /var/www/
and this linux user:
id user1: uid=1000(user1) gid=1000(user1) groups=1000(user1)

I want to allow linux user user1 read/write access JUST to folder A, BUT don't change folder A owner or group.

I have tried these scenarios but none of them were desirable:

• add user1 to group apache:
  cons: user1 will be able to read other files at /var/www/.
• hard-link a folder(ex. folder B) in user1's home to /var/www/A/ and set proper permissions on folder B rather than A:
  cons: hard-links to directories not possible on cross-devices.
• add user1 to sudoers:
  cons: complexity of user1, plus, user1 may broke owner/group policy and/or permissions of folder A by human-error.

any idea?

Answer 1

I'm assuming you want to give user1 access to /var/www/A because you visit the content managed by user1 via http://your.domain/A? Why not have apache redirect the content to a directory under the users home directory?

Alias /A/ /path/to/users/homedir/A

This will achieve the result and not have to change group/user ownership/permissions of the /path/to/users/homedir/A.

However if you want to do it by file permissions, you will only be able to achieve it by changing ownership/permissions of /var/www and /var/www/A.

Create a 'new group' (most unixes provide a groupadd command), add both apache and user1 to it. Change the group ownership of /var/www/A to this 'new group' (with either chown or chgrp). Set the permissions to disallow access to rw for 'new group' and 'other users' to the /var/www directory (chmod 711 /var/www) and give access to the 'new group' for /var/www/A (chmod g+rwx /var/www/A).

References:

Apache Alias Directive

Answer 2

Create a group group1, add apache and user1 to group1, then change the group that owns /var/www/A to group1 using chgrp like so:

# use `-R' if you want to do this recursively, that is grant `group1' access to 
# all sub-directories of `A' as well as access to `A' itself.

# as a regular user with sudo rights:

sudo chgrp -R group1 /var/www/A 

# as root 

chgrp -R group1 /var/www/A 

Thus, user1 will not be a member of apache and so will not be able to read /var/www, but will still be able to read /var/www/A, while apache will also be able to still read /var/www/A.

Lastly, double check that group members have read/write access using chmod like so:

# use `-R' at your own discretion--it acts the same way as `-R' in `chgrp'

# as root 

chmod -R g=rw /var/www/A

# as a regular user with sudo rights

sudo chmod -R g=rw /var/www/A

Or something like that.