Hi experts,I'm in a situation where I need on-disk user data to be accessible by a webserver process but also by the owners when they ssh into the system. My initial ambitious plan for this was to have a "mirror" group for every user that contained the user and also the web server daemon user. With careful management of who created data and where it was created this looked like it was going to work -- the webserver would assert access control policies so the data could only be accessed by the owning user when coming in through the web interface, and the user when ssh'ed in to the system could see all their data but not that of other users. NFSv3 and its 12 (or 16?) group membership limit meant this didn't get me very far in the end.
I'm now wondering if an alternative might be to have all this "dual-access" data owned by "joeblogs" (user) and "webserver" (group) (or vice versa), with a default umask of "u=rwx,g=rwx,o=" (0007). No users would be in the "webserver" group, and the webserver user wouldn't be in the joeblogs group. The complexity here: how to (easily/practically) get the user and webserver to create files with appropriate ownership.
Does anyone have any thoughts or experience with this kind of problem?I've considered sudo policies for a "give_user_access peterpan /path/to/file" script that would:
1. check /path/to/file has "webserver" as the user or group, then do2. chown -R webserver:peterpan /path/to/file; chmod -R u+rwX,g+rwX /path/to/file
and similarly a script "give_webserver_access /path/to/file" that would: 1. check /path/to/file has the current user as the owner or group, then do2. chown -R `whoami`:webserver /path/to/file; chmod -R u+rwX,g+rwX /path/to/file
But neither running these manually nor automatically (cron, on login/logout) seems very attractive.
TIA, Ian -- Ian Stokes-Rees, PhD W: http://portal.nebiogrid.org [email protected] T: +1.617.432.5608 x75 NEBioGrid, Harvard Medical School C: +1.617.331.5993
<<attachment: ijstokes.vcf>>
_______________________________________________ bblisa mailing list [email protected] http://www.bblisa.org/mailman/listinfo/bblisa
