1

I had some problems with permissions, the programmers of my website wanted me to add the admin user to the apache group and then set some permissions. My knowledge of Linux is quite limited, so I found the following online:

chown -R apache:apache /path/to/webserver/www 
chmod -R g+rw /path/to/webserver/www

This worked perfectly, and all was well for few days (BTW, I used "apache" instead of www-data since I'm on CentOS). Now, they're saying they can't upload files to that folder since it is owned by apache user, while they want it to be owned by apache AND admin user.

How do I add 'admin' to ownership as well in addition to 'apache'?

Thanks

Edit:

I used the mount command and got the following:

proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=16377400k,nr_inodes=4094350,mode=755)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)
tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpuacct,cpu)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/net_cls type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb)
configfs on /sys/kernel/config type configfs (rw,relatime)
/dev/sda3 on / type ext4 (rw,relatime,quota,usrquota,grpquota,data=ordered)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=35,pgrp=1,timeout=300,minproto=5,maxproto=5,direct)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime)
mqueue on /dev/mqueue type mqueue (rw,relatime)
/dev/sda5 on /tmp type ext4 (rw,nosuid,nodev,noexec,relatime,data=ordered)
/dev/sda2 on /boot type ext2 (rw,relatime)

Next, I used the tune2fs -l | grep acl and got the following:

Usage: tune2fs [-c max_mounts_count] [-e errors_behavior] [-g group]

        [-i interval[d|m|w]] [-j] [-J journal_options] [-l]

        [-m reserved_blocks_percent] [-o [^]mount_options[,...]] [-p mmp_update_interval]

        [-r reserved_blocks_count] [-u user] [-C mount_count] [-L volume_label]

        [-M last_mounted_dir] [-O [^]feature[,...]]

        [-E extended-option[,...]] [-T last_check_time] [-U UUID]

        [ -I new_inode_size ] device

I am not sure whether it's ok or not - how do I proceed?

1

According to the traditional file permission that's not possible: a file has only a single owner.

Your approach including admin to apache group should work.

However most modern filesystems support ACLs. If you want to use ACLs to give another user read (r) and write (w) permissions then you can use the command setfacl:

setfacl -m user:admin:rw /path/to/webserver/www 

Even if the filesystem you are using supports ACLs, check that it is mounted with support for ACLs. In that case you need to issue the command mount and get the dev related to the filesystem, for example:

[root@centos]#mount

/dev/sda3 on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw)
/dev/sda1 on /boot type ext4 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

The dev for the root filesystem is /dev/sda3.

Now with the command tune2fs you have to issue the command:

[root@centos]tune2fs -l /dev/sda3 | grep acl

Default mount options:    user_xattr acl

In this case it has aclenabled. If it wasn't the case then you have to modify /etc/fstab to include aclon the options as it is explained here.

  • thank you for the quick reply, I tried these and I posted the outcome in the original question since it was too long for the comment, can you please check and let me know how I should proceed? – MAR Mar 29 '16 at 9:49
  • @MAR My bad!!!. The command must be tune2fs -l /dev/sda3 | grep acl where /dev/sda3 is the root filesystem. – jcbermu Mar 29 '16 at 9:55
  • Oh damn I just used "setfacl -m user:admin:rw /path/to/webserver/www" and it deleted the whole folder... what do I do? Edit: actually it might just be hidden from me for some reason, but I can't access the website as well... How do I reverse it? – MAR Mar 29 '16 at 10:00
  • @MAR use getfacl /path/to/webserver/www to check which groups and users have permissions, if you are root then you will have access and it won't be hidden from you. – jcbermu Mar 29 '16 at 10:08
  • @MAR setfacl -b /path/to/webserver/www should restore the ACLs to the prior state. – jcbermu Mar 29 '16 at 10:11
0

jcbermu gived the answer with ACL rule:

setfacl -m user:admin:rw /path/to/webserver/www

But this way admin wouldn't be allowed to enter www directory

Correct ACL is:

setfacl -m user:admin:rwx /path/to/webserver/www

With this command programmers will be granted only rights to create their own files in this very directory. They neither can modify other newly created files within www nor create files in subdirectories of www. So you need to add the following ACL rule as default:

 setfacl -dm user:admin:rwx /path/to/webserver/www

The best way is to modify existent files/subfolders in www to conform to new ACLs and adding default rules for newly created files/subfolders. In this case use the command below instead of the two above:

setfacl -Rm d:u:admin:rwX,u:admin:rwX /path/to/webserver/www

Here rules for existent and newly created files and folders are combined in one string.

-Rm Recursively modify ACLs

u:admin:rwX Set ACLs for user admin for existing files and (sub)folders of starting www folder

d:u:admin:rwX Set ACLs for user admin for newly created files and (sub)folders

You can remove all additional ACLs at any time using

setfacl -Rb /path/to/webserver/www

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.