Giving a webuser rights to files created by apache under his homedir.

  Hi,
Can someone please explain this ACL behaviour to me? I can't figure out 
how to do this.
here is what i'm doing

I set up webusers in a 'wwwusers' group. They have pages that get served 
by apache which is in the group 'www-data'
(pretend that /tmp here is /var/www/):

/web1:/tmp# whoami
root
web1:/tmp# getfacl .
# file: .
# owner: root
# group: root
user::rwx
group::rwx
other::rwx

web1:/tmp# groups test1
test1 : wwwusers
web1:/tmp# groups test2
test2 : wwwusers
web1:/tmp# mkdir test1
web1:/tmp# chown test1:wwwusers test1/
web1:/tmp# mkdir test2
web1:/tmp# chown test2:wwwusers test2/
web1:/tmp# setfacl -m g::- test*
web1:/tmp# getfacl test1/
# file: test1
# owner: test1
# group: wwwusers
user::rwx
group::---
other::r-x

web1:/tmp# getfacl test2
# file: test2
# owner: test2
# group: wwwusers
user::rwx
group::---
other::r-x

web1:/tmp#

/So now i have two dirs that are readable by 'apache:www-data' and are  
fully accessible by their respective owners.
Additionaly by revoking 'rx'  for group user ' test1' is not able to see 
or toutch files in test2's directory  and viceversa.
So far a very standard setup.
 
The problem that many of our webusers face is that they have php scripts 
that let apache create files in a dir that they set writeable by apache 
(blogs, board, galleries, cms etc etc) But once apache creates these 
files they are no longer able to delete them using their user account 
(ftp dreamweaver etc).
/
web1:/tmp# su test1
test1@web1:/tmp$ cd test1/
test1@web1:/tmp/test1$ ls
test1@web1:/tmp/test1$ mkdir apache_data_dir
test1@web1:/tmp/test1$ chmod o+w apache_data_dir/

web1:/tmp# su www-data
web1:/tmp$ whoami
www-data
web1:/tmp$ cd test1/apache_data_dir/
web1:/tmp/test1/apache_data_dir$ echo test>index.html

test1@web1:/tmp/test1/apache_data_dir$ echo foo > index.html
bash: index.html: Permission denied

/I know this is obviously not a problem for users *that know what they 
are doing*  but as a hoster we are dealing with *acctual* people ...

So this should be trivialy solved by ACL i thought....
Just give the webdir of  'test1' a default ACL that gives the user 
'test1' +rwx
He should now be able to do everything on all files under this directory 
no matter who created them.

/web1:/tmp# setfacl -d -m u:test1:rwX test1/
web1:/tmp# getfacl test1/
# file: test1
# owner: test1
# group: wwwusers
user::rwx
group::---
other::r-x
default:user::rwx
default:user:test1:rwx
default:group::---
default:mask::rwx
default:other::r-x/

/test1@web1:/tmp/test1$ mkdir foo
test1@web1:/tmp/test1$ getfacl foo
# file: foo
# owner: test1
# group: wwwusers
user::rwx
user:test1:rwx
group::---
mask::rwx
other::r-x
default:user::rwx
default:user:test1:rwx
default:group::---
default:mask::rwx
default:other::r-x/

Now this seems normal but look what happens to the normal unix perms:

/drwxrwxr-x+ 2 test1 wwwusers 4096 Jul  1 03:43 foo/

Why is that?
the answer is problably the mask. This somehow gives "group" access to 
the file even though both group and the default group are acctualy 
limited to "---"
So why is this happening ?
As far as i know the mask is supposed to be restrictive. So even though 
the mask is rwx in this case, users and groups that have less rights 
whould not just get more because of it.
/group::---
mask::rwx

/should therefore ristrict group's rwx to ---.
But as you can see this is not the case.

Can anyone please explain to me how i can use the default ACL in a way 
that actualy works?

Marius Karthaus.

_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel