1

How can I achieve this files & folders permissions scenario:

Consider these folder:
Folder A: 640 root apache /var/www/A/
Folder www: 640 root apache /var/www/
and this linux user:
id user1: uid=1000(user1) gid=1000(user1) groups=1000(user1)

I want to allow linux user user1 read/write access JUST to folder A, BUT don't change folder A owner or group.

I have tried these scenarios but none of them were desirable:

  • add user1 to group apache:
    cons: user1 will be able to read other files at /var/www/.
  • hard-link a folder(ex. folder B) in user1's home to /var/www/A/ and set proper permissions on folder B rather than A:
    cons: hard-links to directories not possible on cross-devices.
  • add user1 to sudoers:
    cons: complexity of user1, plus, user1 may broke owner/group policy and/or permissions of folder A by human-error.

any idea?

  • 1
    Could you explain why you don't want to change the group of folder A? That really is the best way of achieving what you want. – terdon Aug 6 '13 at 13:32
  • @0x004D44 there's no way to change permissions in such a way that (a) owner and group don't change, and (b) folder is only accessible from certain user accounts. – Alexej Magura Aug 6 '13 at 15:54
  • i can't change the group of folder A @terdon because that folder is managed by another admin account & i don't have access and/or permission to change that. – slashsbin Aug 7 '13 at 7:46
1

I'm assuming you want to give user1 access to /var/www/A because you visit the content managed by user1 via http://your.domain/A? Why not have apache redirect the content to a directory under the users home directory?

Alias /A/ /path/to/users/homedir/A

This will achieve the result and not have to change group/user ownership/permissions of the /path/to/users/homedir/A.

However if you want to do it by file permissions, you will only be able to achieve it by changing ownership/permissions of /var/www and /var/www/A.

Create a 'new group' (most unixes provide a groupadd command), add both apache and user1 to it. Change the group ownership of /var/www/A to this 'new group' (with either chown or chgrp). Set the permissions to disallow access to rw for 'new group' and 'other users' to the /var/www directory (chmod 711 /var/www) and give access to the 'new group' for /var/www/A (chmod g+rwx /var/www/A).

References:

Apache Alias Directive

  • no you assumed wrong @drav-sloan, user1 is a Drupal admin which needs to upload/download Drupal Module files to the Multi-site installation Drupal relying in /var/www/ – slashsbin Aug 7 '13 at 7:39
  • You can still do the above and sym link the directory from /var/www (soft link not hard link) and then set Options +FollowSymLinks for that directory. – Drav Sloan Aug 7 '13 at 9:13
  • it's not just about visiting the content on the web @drav-sloan, the Drupal itself located at /var/www/ should have read/write access to it's modules directory which in above scenario is folder A. – slashsbin Aug 7 '13 at 10:40
  • Setting permissions so the apache process can write to the directory A is all that is required - it being outside of /var/www makes no difference (the symlink takes care of both php access and web content). And this gets around your "cannot makes changes to /var/www ownership/permission" problem. – Drav Sloan Aug 7 '13 at 11:02
  • you are right, i should see the it this way, tnx – slashsbin Aug 7 '13 at 12:31
1

Create a group group1, add apache and user1 to group1, then change the group that owns /var/www/A to group1 using chgrp like so:

# use `-R' if you want to do this recursively, that is grant `group1' access to 
# all sub-directories of `A' as well as access to `A' itself.

# as a regular user with sudo rights:

sudo chgrp -R group1 /var/www/A 

# as root 

chgrp -R group1 /var/www/A 

Thus, user1 will not be a member of apache and so will not be able to read /var/www, but will still be able to read /var/www/A, while apache will also be able to still read /var/www/A.

Lastly, double check that group members have read/write access using chmod like so:

# use `-R' at your own discretion--it acts the same way as `-R' in `chgrp'

# as root 

chmod -R g=rw /var/www/A

# as a regular user with sudo rights

sudo chmod -R g=rw /var/www/A

Or something like that.

  • apache is not an user, it's a group, and i can't add a group to another group in linux, can i? – slashsbin Aug 7 '13 at 7:37
  • @0x004D44 I have no idea, but the general idea would work. Maybe, you could... I dunno. There really ought to be a way to add a group to another group, though. – Alexej Magura Aug 7 '13 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.