I have a Web application deployed via Tomcat that allows upload of files in a dir
files. These files are uploaded by Tomcat with owner
tomcat:tomcat and permissions
640. I need to mantain the group
tomcat because other users need it for administration purposes.
On the download side, I have a Nginx that supplies the files for users.
The problem is that Nginx cannot access the uploaded files, because it uses a user
- I cannot add
www-datato the group
tomcatfor security reasons.
- I cannot substitute
www-data, because I need the
tomeegroup and I cannot let tomee create ALL files under the
www-datagroup (f.ex. tomee would create logs under
tomee:www-data, which is undesired - only the uploads in any case could have this)
- I cannot let
othershave any permissions on the files, for security reasons. In any case I cannot change the default
640Tomcat mask because (bad Tomcat design?) it would affect EVERY file that Tomcat creates.
- I could use
chmod g+sbut this does not seem to affect the files recursively (Tomcat creates also directories in which it then uploads the file)
How can I solve this issue?