0

I have a weird issue with folder permissions on my ubuntu server.

I have 2 users which need access to nginx logs, www-data (nginx) and dd-agent (datadog, a logging service).

I created a group logusers and added both users to that group, then I changed permissions as follows:

sudo chown -R dd-agent:logusers /var/log/nginx/

I can see the following for ls -l:

drwxr-xr-x 2 dd-agent logusers 4096 May 29 06:25 nginx

Then I check both the status of the dd-service and nginx-service, and both are fine, but after a couple of hours, datadog reports a permission denied error for opening a file inside /var/log/nginx/.

How can I make sure both users have proper access? Why does this change over time?

--Edit: Restarting the datadog-agent service and checking its status again shows no permission errors. This is weird.

  • 2
    has that file been newly created, probably with different rights? have you checked ls -la /var/log/nginx/specific-file – AlexOnLinux May 29 at 7:18
  • I don't understand why you create a new group to do that. Why don't you add the users to the www-data and dd-agent groups? – mook765 May 29 at 7:20
  • 1
    @AlexOnLinux Indeed is has been. -rw-r----- 1 dd-agent logusers 118883 May 29 09:25 access.log – ffritz May 29 at 7:28
  • Also remind : newly created files in /var/log/nginx/ (after the chown-command) will not be associated with the grouplogusers. – mook765 May 29 at 7:28
  • @mook765 So sudo usermod -a -G www-data dd-agent and sudo chown -R www-data:www-data /var/log/nginx/ should do it right? – ffritz May 29 at 9:01
0

if you want your new created files to be created as the group you specified to the folder you could do the following

sudo chmod g+s /var/log/nginx/

this will set the SGID-Bit ( Set Group ID ) to the folder with the result that every new created file inside that folder will inherit the group of the folder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.