2

How can I achieve this files & folders permissions scenario:

Consider these folder:
Folder A: 640 root apache /var/www/A/
Folder www: 640 root apache /var/www/
and this linux user:
id user1: uid=1000(user1) gid=1000(user1) groups=1000(user1)

I want to allow linux user user1 read/write access JUST to folder A, BUT don't change folder A owner or group.

I have tried these scenarios but none of them were desirable:

  • add user1 to group apache:
    cons: user1 will be able to read other files at /var/www/.
  • hard-link a folder(ex. folder B) in user1's home to /var/www/A/ and set proper permissions on folder B rather than A:
    cons: hard-links to directories not possible on cross-devices.
  • add user1 to sudoers:
    cons: complexity of user1, plus, user1 may broke owner/group policy and/or permissions of folder A by human-error.

any idea?

3
  • 1
    Could you explain why you don't want to change the group of folder A? That really is the best way of achieving what you want.
    – terdon
    Aug 6, 2013 at 13:32
  • @0x004D44 there's no way to change permissions in such a way that (a) owner and group don't change, and (b) folder is only accessible from certain user accounts. Aug 6, 2013 at 15:54
  • i can't change the group of folder A @terdon because that folder is managed by another admin account & i don't have access and/or permission to change that.
    – slashsbin
    Aug 7, 2013 at 7:46

2 Answers 2

1

I'm assuming you want to give user1 access to /var/www/A because you visit the content managed by user1 via http://your.domain/A? Why not have apache redirect the content to a directory under the users home directory?

Alias /A/ /path/to/users/homedir/A

This will achieve the result and not have to change group/user ownership/permissions of the /path/to/users/homedir/A.

However if you want to do it by file permissions, you will only be able to achieve it by changing ownership/permissions of /var/www and /var/www/A.

Create a 'new group' (most unixes provide a groupadd command), add both apache and user1 to it. Change the group ownership of /var/www/A to this 'new group' (with either chown or chgrp). Set the permissions to disallow access to rw for 'new group' and 'other users' to the /var/www directory (chmod 711 /var/www) and give access to the 'new group' for /var/www/A (chmod g+rwx /var/www/A).

References:

Apache Alias Directive

5
  • no you assumed wrong @drav-sloan, user1 is a Drupal admin which needs to upload/download Drupal Module files to the Multi-site installation Drupal relying in /var/www/
    – slashsbin
    Aug 7, 2013 at 7:39
  • You can still do the above and sym link the directory from /var/www (soft link not hard link) and then set Options +FollowSymLinks for that directory.
    – Drav Sloan
    Aug 7, 2013 at 9:13
  • it's not just about visiting the content on the web @drav-sloan, the Drupal itself located at /var/www/ should have read/write access to it's modules directory which in above scenario is folder A.
    – slashsbin
    Aug 7, 2013 at 10:40
  • Setting permissions so the apache process can write to the directory A is all that is required - it being outside of /var/www makes no difference (the symlink takes care of both php access and web content). And this gets around your "cannot makes changes to /var/www ownership/permission" problem.
    – Drav Sloan
    Aug 7, 2013 at 11:02
  • you are right, i should see the it this way, tnx
    – slashsbin
    Aug 7, 2013 at 12:31
1

Create a group group1, add apache and user1 to group1, then change the group that owns /var/www/A to group1 using chgrp like so:

# use `-R' if you want to do this recursively, that is grant `group1' access to 
# all sub-directories of `A' as well as access to `A' itself.

# as a regular user with sudo rights:

sudo chgrp -R group1 /var/www/A 

# as root 

chgrp -R group1 /var/www/A 

Thus, user1 will not be a member of apache and so will not be able to read /var/www, but will still be able to read /var/www/A, while apache will also be able to still read /var/www/A.

Lastly, double check that group members have read/write access using chmod like so:

# use `-R' at your own discretion--it acts the same way as `-R' in `chgrp'

# as root 

chmod -R g=rw /var/www/A

# as a regular user with sudo rights

sudo chmod -R g=rw /var/www/A

Or something like that.

2
  • apache is not an user, it's a group, and i can't add a group to another group in linux, can i?
    – slashsbin
    Aug 7, 2013 at 7:37
  • @0x004D44 I have no idea, but the general idea would work. Maybe, you could... I dunno. There really ought to be a way to add a group to another group, though. Aug 7, 2013 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .