Handling Web Server file permission: The Last Guide

If you have to work with a LAMP stack one of the first things you do is setting up permission for your user and web server so that you can deploy files correctly and securely and also ina. way that the server can read and execute them.

This often becomes a headache quickly when the two user groups require specific permission sets on specific files to work securely.

The most popular solution

Almost every StackOverflow answer and suggested method will involve giving developers the same user group access as the webserver. Most commonly it's access to www-data . This however comes with it's own set of baggage.

• If you have several web applications running side-by-side on your web server, you'll have to juggle a lot more with groups and sub-groups just to prevent Developer A to be able to see and modify Application B.
• When a developer creates a file, the file is owned by the developer, and might not be readable (nor writable if needed) properly by the webserver process. It can be mitigated by careful ACL access. But often does become a hassle

I recently found out about another alternate way to handle permissions which works fine and doesn't have any of these drawbacks.

Solution: The bindfs way

This way ensures a developer could read and write files of an application with its own unshared user / group, while allowing the webserver to have it's own and developer-unscrewable permissions on the files of the said application.

With bindfs, developers access applications via dedicated filesystem mountpoints (placed in their home dir), acting as file-permission filters, presenting files like they're owned by themselves, whereas the files are really owned by the web server user (like www-data)

How to use

This assumes the user is "rabimba" and "HTML" is your folder with webserver

# Installing bindfs (just the first time)
rabimba@e2e-55-141 $ apt-get update 
rabimba@e2e-55-141 $ apt-get -y install bindfs
# Creating the application mountpoint
rabimba@e2e-55-141 $ mkdir -p /home/rabimba/www/html 
rabimba@e2e-55-141 $ chown -Rf rabimba:rabimba /home/rabimb/html 
rabimba@e2e-55-141 $ chmod -Rf 770 /home/rabimba/html

Then, edit the content of /etc/fstab and add this line

bindfs#/var/www/html /home/rabimba/www/html fuse force-user=rabimba,force-group=rabimba,create-for-user=www-data,create-for-group=www-data,create-with-perms=0770,chgrp-ignore,chown-ignore,chmod-ignore 0 0

Save the file, and proceed with mounting application

rabimba@e2e-55-141 $ mount /home/rabimba/www/html

 Now your happy developers can just work in the desktop HTML folder and everything will be automatically reflected in the webserver folder with no permission conflict anymore. Since they both are owned actually by different user groups.