Linux – Permissions, owner, group inheritance?

groupslinuxpermissionsusers

I don't understand restrictions in terms of directories nesting. For example, /var/www/folder/index.html directories. What permissions, owner, group should every directory and file have? Is there such a thing as inheritance here? I mean, do outer's directory permissions, owner, group affect its inner directories and files?

All answers here explain permissions only in terms of one separate directory and a file in it. Nobody pays attention to inheritance.

For example, I want to set up an Nginx server to serve /var/www/folder directory and all its sub-directories and files. How should I think about permissions, owners, groups?

/var – what permissions? what are owner and group?

/var/www – what permissions? what are owner and group?

/var/www/folder1 – what permissions? what are owner and group?

/var/www/folder/folder2/ – what permissions? what are owner and group?

/var/www/folder/folder2/index.html – what permissions? what are owner and group?

Best Answer

In a word, no. Inheritance does not happen automatically.

Presumably, you will be running Nginx as user www-data, therefore, you would want to give recursive ownership of /var/www to www-data:www-data.

Related Solutions

Delegate permissions to subfolder in TFS project

There is no way to do this out of the box. If you're only going to be doing it rarely, the manual process of denying on the parent folders is going to be most efficient.

If, however, this is a task you think you'll find yourself repeating fairly often, you can create a utility using the TFS API to do it for you.

(Something along these lines. Warning, this is not tested)

vcs = //...VersionControlServer reference...

string checkinPath = @"$/MyProject/Sources/Whatever";
string identityName = @"[MyProject]\Contributors";
string[] removesNone = new string[]{ };    
string[] allowsNone = new string[]{ };
string[] deniesNone = new string[]{ };
string[] allowsCheckin = new string[]{ PermissionChange.ItemCheckin };
string[] deniesCheckin = new string[]{ PermissionChange.ItemCheckin };


PermissionChange pc = new PermissionChange(
    checkinPath, identityName, allowsCheckin, deniesNone, removesNone);

vcs.SetPermissions(new SecurityChange[]{ pc } );

// walk up the path denying on parent folders
checkinPath = checkinPath.Substring(0, checkinPath.LastIndexOf('/'));
while (checkinPath.Length > 2)
{
        PermissionChange pc = new PermissionChange(
            checkinPath, identityName, allowsNone, deniesCheckin, removesNone);

        vcs.SetPermissions(new SecurityChange[]{ pc } );

        checkinPath = checkinPath.Substring(0, checkinPath.LastIndexOf('/'));
}

Linux – How to setup linux permissions for the WWW folder

After more research it seems like another (possibly better way) to answer this would be to setup the www folder like so.

sudo usermod -a -G developer user1 (add each user to developer group)
sudo chgrp -R developer /var/www/site.com/ so that developers can work in there
sudo chmod -R 2774 /var/www/site.com/ so that only developers can create/edit files (other/world can read)
sudo chgrp -R www-data /var/www/site.com/uploads so that www-data (apache/nginx) can create uploads.

Since git runs as whatever user is calling it, then as long as the user is in the "developer" group they should be able to create folders, edit PHP files, and manage the git repository.

Note: In step (3): '2' in 2774 means to 'set Group ID' for the directory. This causes new files and sub directories created within it to inherit the group ID of the parent directory (instead of the primary group of the user) Reference: http://en.wikipedia.org/wiki/Setuid#setuid_and_setgid_on_directories

Related Topic