What is the right permissions to set for /war/www/mywebsite folder permissions, apache user and group of developers - linux

Question

I have a question about the right approach for /var/www/somesite folder permissions.
The story is like this.
I have 5 developers, I put them all as members of devteam group
I have the website folder /var/www/mywebsite and I know that /var/www/mywebsite/info folder rquires apache to write into it. I'm using ACLs because I believe that's the best approach to control what I'm looking for.
So... I configured the whole thing like this:
The structure:
joel#server:$ ls -la /var | grep www
drwxrwxr--+ 3 www-data www-data 4096 Jul 11 01:12 www
joel#server:$
joel#server:$ ls -la /var/www
drwxrwxr--+ 3 www-data www-data 4096 Jul 11 01:12 .
drwxr-xr-x 15 root root 4096 Jul 11 14:37 ..
dr-xrwsr--+ 16 www-data www-data 4096 Jul 12 06:49 mywebsite
joel#server:$
You can see that setgid is set on mywebsite so that it'll make all executables to run with the privileges of the group
for /var/www
joel#server:~$ sudo getfacl -p /var/www
# file: /var/www
# owner: www-data
# group: www-data
user::rwx
user:www-data:r-x
group::r-x
group:www-data:rwx
group:devteam:rwx
mask::rwx
other::r--
for /var/www/mywebsite
joel#server:~$ sudo getfacl -p /var/www/mywebsite
# file: /var/www/mywebsite
# owner: www-data
# group: www-data
# flags: -s-
user::r-x
user:www-data:r-x
group::r-x
group:www-data:rwx
group:devteam:rwx
mask::rwx
other::r--
for /var/www/mywebsite/info
joel#server:~$ sudo getfacl -p /var/www/mywebsite/info
# file: /var/www/mywebsite/info
# owner: joel
# group: www-data
# flags: -s-
user::rwx
user:www-data:rwx
group::r-x
group:www-data:rwx
mask::rwx
other::r--
Now... everything seems to work, except that when one of the developers tries to use git on that folder, they get this error:
fatal: not a git repository (or any of the parent directories): .git
Since I did run git init --shared=group and I know for sure that the directory structure does have .git in it (see structure below), so... I was sure it's permissions.
Once I've added the users to be part of www-data group, they were able to run all the git commands they wanted. (it makes sense, since the files in the directory are with owner: joel group: www-data).
The structure looks like that:
joel#server:~$ ls -la /var/www/mywebsite/
total 107928
dr-xrwsr--+ 16 www-data www-data 4096 Jul 12 06:49 .
drwxrwxr--+ 3 www-data www-data 4096 Jul 11 01:12 ..
-rwxrwxr--+ 1 joel www-data 213 Jul 11 01:25 .editorconfig
-rw-rw-r--+ 1 joel www-data 2013 Jul 11 20:48 .env
drwxrwxr-x+ 8 joel www-data 4096 Jul 12 10:55 .git
-rwxrwxr--+ 1 joel www-data 111 Jul 11 01:25 .gitattributes
-rwxrwxr--+ 1 joel www-data 309 Jul 11 01:25 .gitignore
-rwxrwxr--+ 1 joel www-data 412 Jul 11 21:00 .htaccess
-rwxrwxr--+ 1 joel www-data 174 Jul 11 01:25 .styleci.yml
drwxrwsr--+ 12 joel www-data 4096 Jul 11 01:25 helper
-rwxrwxr--+ 1 joel www-data 1686 Jul 11 01:25 mainly
-rw-rw-r--+ 1 joel www-data 1304 Jul 11 01:25 pipelines.yml
drwxrwsr--+ 3 joel www-data 4096 Jul 11 01:25 info
-rwxrwxr--+ 1 joel www-data 707 Jul 11 01:25 story.php
-rwxrwxr--+ 1 joel www-data 2069 Jul 11 09:50 offset.json
The reason it's me as the owner of everything, is because I was the one who pulled it from the repository to begin with, but, it'll probably change since these developers will pull the stuff they need while logging in with their credentials, and, it'll change.
On to my questions:
Is this the right approach to the order and structure of the website?
I don't want my developers to be part of www-data group because, well, because that group is not for them! it's for apache to run the server. What can I do? How can I set it up currectly so that they'll be able to work git without being part of the www-data group? (I thought about chaning the ownership of the whole website to be owned by the devteam group, but, what will happened with apache2 service then?)
How come my /var/www/mywebsite/info doesn't have devteam permissions in it's ACL (do I really need to set it up for all subfolder if it's already setup for the parent?)
Why do I have mask::rwx as part oof my ACL configuration? I don't rememebr I set it up.
Am I doing the right thing with setting the setgid in that way that all my folders are will have the group privileges for executables?
I really appriciate your help on this subject.

Answer 1

The right approach (TM) is to not give anybody access to your server, but have them go through version control and a controlled deployment process - this way you'll have a chance to restore the server after some failure situation, an audit trail of what software was installed when etc.
As a minimum, either you or a script might pull a tagged version from a central git repo every now and then. This way it's only you or the script to ever write to Apache's directory. All developers collaborate through git, in a central repository. They send pull requests, and you'll have a trail of who did what when and why.
On the central repository, somebody merges pull requests, tags - and you're set.
Of course - you can go more fancy, but the situation that you describe sounds like a bad workaround for a problem that nobody should have (live write access to a server, for a dev team of >1 size)
Edit: this even holds on a development machine. If hate to make a change and debug why it doesn't work, only to find out that it's due to somebody else's change, after an hour of useless debugging