How to bind mount a folder in multiple user's home directories with full permissions

Question

I have a web server serving files from /var/www/vhosts/mysite. What I'm looking to do is mount this vhosts folder in /home/myuser/vhosts so that a user can log in, edit any files and log out. The problem is that the mount does not ignore the permissions in that folder. Some files could be created by www-data or another user. If they are created by another user then www-data has trouble reading / modifying them as well.

What I've tried so far is to create a bind mount using fstab. The folder mounts successfully in the user's home directory, and using acl i was able to allow them to write to it by assigning a group to the folder with rwx and adding www-data and the user to the group. I'm wondering if there is a way to bind mount the folder, but have the permissions be unaffected so www-data can always read/write/execute on it without issues, while allowing the user full permissions as well.

Answer 1

You want to add these users to the www-data group first. Then the intended method is to use chmod g+s /home/user/vhost. This will set the SGID on this folder meaning that it's group will be used for new files. Unfortunately, this doesn't help for the sub dirs. To keep those up to date you'll need to regularly run this after directory tree modifications: find /home/user/vhost -type d -exec chmod g+s {} \; . This will search for all sub dirs and enable the SGID. The most annoying part is that this will need to be done to any parent dirs before adding children meaning that sometimes you need to run this several times when making changes and if you forget to do that then you'll need to just do the chown command anyway: find /home/user/vhost -type d -exec chown user:www-data {} \;.

This is what I say to do but I find that this whole plan is just annoying for me though. In reality what I do is work on a development server with completely unrelated permissions. After I make changes I have a script that syncs to prod server and sets all ownership and permissions every time to ensure that everything is ALWAYS right. This method saves a lot of time because I never need to worry about why permissions are borked. I just run the script and it is all magically working again.