I have a Web application deployed via Tomcat that allows upload of files in a dir files. These files are uploaded by Tomcat with owner tomcat:tomcat and permissions 640. I need to mantain the group tomcat because other users need it for administration purposes.

On the download side, I have a Nginx that supplies the files for users.

The problem is that Nginx cannot access the uploaded files, because it uses a user www-data:www-data.

  • I cannot add www-data to the group tomcat for security reasons.
  • I cannot substitute tomee group for www-data, because I need the tomee group and I cannot let tomee create ALL files under the www-data group (f.ex. tomee would create logs under tomee:www-data, which is undesired - only the uploads in any case could have this)
  • I cannot let others have any permissions on the files, for security reasons. In any case I cannot change the default 640 Tomcat mask because (bad Tomcat design?) it would affect EVERY file that Tomcat creates.
  • I could use chmod g+s but this does not seem to affect the files recursively (Tomcat creates also directories in which it then uploads the file)

How can I solve this issue?


I think I have solved it but need to do more testing before accepting the solution.

  • sudo apt install acl (based on Ubuntu)
  • sudo chown tomcat:www-data files
  • sudo chmod g+s files
  • sudo setfacl -Rm d:g:www-data:r files

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.