Folder permissions to certain folder

Question

I want to be able to only allow a user read/write permissions to a certain folder, and not any of the parent folders

so for instance

mywebsite

Can only access /var/www/html/mywebsite

And not /var/www/html/otherwebsite

I have tried:

chown -R www-data /var/www/html
chown -R mywebsite:www-data /var/www/html/mywebsite
chmod -R 770 /var/www/html

The problem I am getting is that when logged in to mywesbite I don't have read write permissions to the mywebsite folder, or any other folder for that matter

What am I doing wrong?

Answer 1

To give user mywebsite read/write permission inside /var/www/html/mywebsite:

chown -R mywebsite /var/www/html/mywebsite 

That should be sufficient. You should not have to alter group owner or permissions because the user owner should be given read/write permissions already.

If you wanted to grant a group read/write permission inside that folder, say, group my-group, you'd need:

chgrp -R my-group /var/www/html/mywebsite 
chmod -R g+w /var/www/html/mywebsite

Important notes

1. Don't set the ownership (either user or group) of files within /var/www to the www-data user. The point of having the web server run as the www-data user is that this is an unprivileged account, unable to modify any files. If you set some files to be owned by this user, you are negating that security measure. If you need your web server to be able to modify certain files, only set ownership for those particular files and be very careful not to allow direct execution (eg via PHP) of them. In general, never set it so that www-data can modify files.

2. When doing a recursive chmod, it is often better to use letters than numbers, eg chmod -R g+w something rather than chmod -R 770 something. This is because the former is able to modify only the permission you want, and leave the others. By default, directories and files will have different "execute" permissions - files will have it off (eg 644) and directories on (eg 755) because this permissions has a different meaning for directories. If you do chmod -R 770 something then regular files will have execute permissions turned on. In general it's a good idea to only modify what you need.

   Another thing to note is that 770 would remove the world-readable permission, which will prevent the web server (which runs as an unprivileged user) being able to read it. In this case it's also preventing the user mywebsite being able to see the /var/www/html/mywebsite directory at all, because you've set the parent directory /var/www/html to 770.

Answer 2

What I did on Ubuntu 16.04 (for my future reference too):

sudo groupadd web-content                 # creates a new group 'web-content'
sudo usermod -a -G web-content myuser     # adds 'myuser' to the group
sudo usermod -a -G web-content www-data   # adds 'www-data' to the group
sudo chown -R myuser:web-content /var/www/html          # changes owner to 'myuser' and 'web-content' group
sudo find /var/www/html -type f -exec chmod 640 {} \;   # applies rw for myuser and r permissions to all files
sudo find /var/www/html -type d -exec chmod 750 {} \;   # applies rwx for myuser and rx permissions to all directories
sudo systemctl restart apache2.service    # restarts the apache web service

Please let me know if this is not secure or sensible.

(Note. I just wanted to add this as an additional comment to my previous comment, but it lost the formatting of the code lines when I did that)