how to fix permission behavior of www folder

Question

I'm working in the www directory of apache. I need to do this because other people in my company need to see my work constantly - whether to access updated versions of things I'm working on (mostly css files) or to give me feedback (this is all on a local network).

I'm working with a live build of the latest Ubuntu 14.04, with Apache 2.2. And the permission system is giving me a headache. Mostly this is due to the surprising inconsistency when working with the www directory - sometimes I can access everything, sometimes I can access them but can't copy to other places, sometimes some directories are inaccessible. I think the last update presented more weird limitations that didn't exist before.

I always work around this somehow. Either I sudo cp through command line, or I do sudo nautilus or I change the permissions for a limited period of time (apache needs the permissions to be for www-data, else when you try to access the site through localhost the site receives a 403 for all its static files).

But I've had enough, this is ridiculous. I need that directory to behave as if I own it, but not have any clash with Apache.

I can find a lot of answers around this site about permission problems, but like I said - I don't have a problem solving this temporarily. But I'm looking to understand what's the right way to work with the www directory, without breaking anything and without having to sudo every little thing.

Thanks in advance

Answer 1

To me, keeping the directories' owned by root would be fine. What I prefer is, create a group say www-editor and make yourself (and any other co-editors) member of the group. chgrp the www folder to www-editor and grant full permission to the group.

By default, the www-editor group should have write permission to the folders, and files newly written should have similar permissions. It would be handy to turn the sticky bit on for www and all subdirectories (i.e. sudo chmod g+s www).

In that way, any files you created will be owned by you (not root as sudo not required) and owned by group www-editor. A sample of ls -l on directory www will look like:

drwxrwsr-x  8 root    www-editor 4096 Feb 28 00:00 .
drwxr-xr-x 14 root    root       4096 Mar 16 10:14 ..
-rw-rw-r--  1 ken_l   www-editor 1150 Feb  8  2013 favicon.ico
-rw-rw-r--  1 root    www-editor  177 Dec 25  2012 index.html
drwxrwsr-x  2 ken_l   www-editor 4096 Jun 12  2013 main

From the example above, ken_l created index.html and copied favicon.ico to www without sudo.

Permissions for www-data should be minimized to reduce security risks. Therefore directories should, by default, read-only by others (including www-data). Of course you can always fine tune permissions of specific directories as needed.