The fix I gave is just to do what is currently in the code already, but
do it with the semantics I believe you expect.
I don't know of a way of stopping a user changing umask for a process
(unless there is a restricted shell - umask is a builtin), although a
shared host can set a default umask restriction that is tighter than
the usual 022 or 027 - which may be where the problems are occurring
because mkdir -p doesn't do what you expect.
However perhaps it is time to question why you need permissions so lax.
For my Multi Tenant project I've had to reimplement a few of the tasks
in standard - firstly because I need relative paths in a system where
each Unix user has their own copy of the code and their own database,
and secondly so that I can get the permissions straightened. It's no
good enforcing infrastructure separation if tenant1 can see tenant2's
code base.
The model I've come up with works as follows:
- user 'www-data' runs the web-server
- user 'mysql' runs the database
- a normal deployment user runs the Mongrels.
A normal user sits in their own personal group (therefore user 'deploy'
has a group 'deploy' that is personal to them). You then set a default
umask of 077 on the system so that nobody can see anybody else's files.
This works for everything except the directories that the web-server
needs to see (public and system) so that it can directly serve them to
the client. To get this to work you add the 'www-data' user to the
personal group of the deployment user, and set the group 'access'
permission on the relevant directories (You don't need read permission
on a directory to use the files within it if you know what they are
called) - plus group read permissions on the relevant files.
That way the web server can see the relevant files of all the tenants,
but the tenants can't see anything else other than their own files.
That, I think, is as tight as you can get and still have things work as
expected. The challenge I've been having is finding a way of getting
the Capistrano ssh connections to fire up with a default umask of 077.
I have a feeling I'm going to have to do something with the sshd
settings or PAM to get that to work.
Food for thought anyway.
NeilW
--~--~---------~--~----~------------~-------~--~----~
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/capistrano
-~----------~----~----~----~------~----~------~--~---
