Create files that both www-data and theuser can edit

permissionswebserver

I have a directory to store invoices –

drwxrwxr-x  2 me www-data   49152 Sep  9 13:38 invoices

There are two applications that write files to this dir.

PHP web application

-rw-r–r– 1 www-data www-data 7681 Sep 9 13:38 invoice_1.html
Python script

-rw-rw-r– 1 me me 8911 Sep 4 06:04 invoice_2.html

Now I want to overwrite invoice_2.html from the web application. How do I do that?

I don't want to add www-data to me group. I don't know how but that will make my server vulnerable to security threats.

Help me out.

Thanks.

Best Answer

Two options (both carried out as root):

First

If you're happy to have me be a member of the www-data group:

Add the user me to the www-data group:

# usermod -a -G www-data me

Set the SetGID flag on the invoices directory:

# chmod g+s /<path>/<to>/invoices

Now, any files created in the invoices directory will have their group set to www-data (the group of the directory) due to the SetGID bit being set. As the user me is in this group, then the user will have permission to write to that file.

Second

If you don't want the user me to be a member of the www-data group, then...

Create a new group - invoices.

# groupadd invoices

Add the users me and www-data to this group.

# usermod -a -G invoices me
# usermod -a -G invoices www-data

Change the group of the invoices directory to this new group (invoices).

# chown .invoices /<path>/<to>/invoices

Make sure that the group invoices has write permission on the directory:

# chmod g+w /<path>/<to>/invoices

Set the SetGID flag on the invoices directory:

# chmod g+s /<path>/<to>/invoices

Now, the invoices directory will be owned by the invoice group and any files created within it will have their group set to invoices due to the SetGID bit being set on the directory. Both me and www-data have write permission as they are members of the invoices group which has this write permission.

Related Solutions

PHPStorm Editing – How to Edit /var/www Files Using PHPStorm

PhpStorm should use the same permissions as the user that runs/ launches the script (yourself). Add yourself to the www-data group, or set up a new group.

Let's say you created a new group called "www-pub" and added yourself to it as per instructions.

Remember to log out and back in to have the new group membership take effect. Test your group membership with the groups command.

Then, change permissions of the /var/www directory as follows:

chown -R :www-pub /var/www
- Set the group of all files in /var/www to "www-pub" recursively
chmod -R o+r /var/www
- Allows everyone (including apache) to read all files in /var/www
chmod -R g+w /var/www
- Allows group members to write to all files in /var/www
find /var/www -type d -exec chmod g+s {} \;
- sets new files to retain the group of the directory they are created in

If you need apache to also be able to write files (or read files without giving read to everyone else), add apache's user (usually "www-data") to the "www-pub" group.

Also, in PhpStorm's Deployment Options, make sure "override default permissions on (files/ directories)" are either unchecked or set to allow writing by group.

This process should also work for IntelliJ IDEA/ Webstorm.

Give group permissions to specific device

You'll probably want to write a rule for udev. Assuming no changes to udev.conf, your rules file should be placed into /etc/udev/rules.d/; it may help you to crib from packages' rules which may be found in /lib/udev/rules.d/.

Writing good rules is a bit of an acquired art, but you could start with something simple if you have no other ttyACM* devices:

# Give web server read/write access to camera
KERNEL=="ttyACM?", ACTION=="add", \
   MODE:="0660", \
   GROUP:=www-data

You'll want to put the above into a file such as /etc/udev/rules.d/10-camera.rules - it must end in .rules; the two-digit numeric prefix helps get rules in the right sequence, and you might need to adjust it. The bit in between is, of course, just to help you recognise why you created it. :-)

Best Answer

Related Solutions

PHPStorm Editing – How to Edit /var/www Files Using PHPStorm

Give group permissions to specific device

Related Question