Permissions issue on writable folders

[mareg]

I've updated my little project to allow uploading images. Images are stored in var/logos folder. Initially I've uploaded around 800 images, done by user marek (myself), all works fine - apache can read them and display them on the web.

Uploading images works fine too, images are saved, displayed on front end just fine. The problem shown up when I tried to deploy my application again with deployer:

In Client.php line 103:
                                                                                                                                  
  The command "cd /var/www/example.org/releases/41 && (setfacl -L -R -m u:"apache":rwX -m u:`whoami`:rwX var)" failed.  
                                                                                                                                  
  Exit Code: 1 (General error)                                                                                                    
                                                                                                                                  
  Host Name: example.org                                                                                               
                                                                                                                                  
  ================                                                                                                                
  setfacl: var/logos/a/u/a/Austrian_Airlines'_logo_(2018).png: Operation not permitted                                            
                                                                                                                                  

Listing files shows new file was uploaded by user apache, but group remained as marek:

$ ll var/logos/a/u/a/
total 56
-rw-rw-r--+ 1 apache marek 16038 Jan 17 16:33 Austrian_Airlines'_logo_(2018).png
-rw-rw-r--+ 1 marek  marek 40799 Jan 12 18:23 Austrian_Logo_Red_RGB.jpg

Here's the getfacl output for the newly uploaded file:

$ getfacl var/logos/a/u/a/Austrian_Airlines\'_logo_\(2018\).png 
# file: var/logos/a/u/a/Austrian_Airlines'_logo_(2018).png
# owner: apache
# group: marek
user::rw-
user:apache:rwx			#effective:rw-
user:marek:rwx			#effective:rw-
group::r-x			#effective:r--
mask::rw-
other::r--

and for one I've copied by rsync earlier:

$ getfacl var/logos/a/u/a/Austrian_Logo_Red_RGB.jpg 
# file: var/logos/a/u/a/Austrian_Logo_Red_RGB.jpg
# owner: marek
# group: marek
user::rw-
user:root:rw-
user:apache:rw-
user:marek:rw-
group::rw-
mask::rw-
other::r--

What have I done wrong?
I can fix the deployment issue by running sudo chown marek.marek -R var/logos but I shouldn't need to do that, if I understand correctly what deployer does on deployment.

[antonmedv]

So what’s the problem? Uploaded via apache user files have owner as apache.

[mareg]

next time I try to deploy the application, deployer fails with the following error:

In Client.php line 103:
                                                                                                                                  
  The command "cd /var/www/example.org/releases/41 && (setfacl -L -R -m u:"apache":rwX -m u:`whoami`:rwX var)" failed.  
                                                                                                                                  
  Exit Code: 1 (General error)                                                                                                    
                                                                                                                                  
  Host Name: example.org                                                                                               
                                                                                                                                  
  ================                                                                                                                
  setfacl: var/logos/a/u/a/Austrian_Airlines'_logo_(2018).png: Operation not permitted     

[mareg]

So it looks like either deployer sets file permissions incorrectly or I am missing something.
I have a var/logs where apache can write files and it doesn't break the deployment.

[antonmedv]

I'm still not getting your problem. What is the desired outcome? What permissions should be in place? There are dozens of variations of server configuration, one solution uses separate user for server and deployer: for example, use "deployer" user for both server and deployment.

[mareg]

Desired outcome is not to see the error, while keeping the deployer user and server user separately.