24 Jul 03
mimosa

 
--journals--

people i know
the boston diaries
resilient's livejournal
azagthoth's livejournal
[more]

other great journallers
little.yellow.different.
medea sin
the daily brad
[more]

--join the notify list--


     

brought to you by
conman laboratories

 
Trade Me!
at
BlogShares
Listed on BlogShares
 
previous search next

The Problems with Unix Permissions

Or

A Guest Entry by Sean Conner

This is Sean speaking, doing a rather impromptu entry to explain to several people who have signed up for email notifitications why there were several notifications when there's only this entry (that is, if you weren't around for all the fun of seeing all the various test messages). You see, it all began when Spring told me that the email updating was broken &hellip

Normally, she uses the web interface to update entries here; I think she may have used the email interface once or twice and that's when this software was first created, and certainly not since the email system was switched from Sendmail to Postfix, and certainly not since the new server was installed. It honestly didn't occur to me that the email interface could break separately from the web interface, since they share the same program; the only difference is where the data comes from and that is abstracted out enough not be that much of a concern, since both the web and email interfaces share about 90% of the code.

But in tracking down the problem, it became very apparent that the email side of things was broken. And, as usual, the cause of this was the rather braindead Unix permissions scheme. You have root, which can do anything, then everybody else, which often can't. Also, each file has a single owner, belongs in a single group and yes, there are permissions for everybody else but unless you want everybody else writing to the file, you typically leave the permissions as read only.

Problem here is, we have two possible points of entry—Apache, or Postfix.

And they have very different ideas of who they are.

This is compounded by the fact that Spring owns the directory the files are stored in, which is her, spring and not Apache, which is www nor Postfix, which for histerical reasons thinks it's nobody.

And nobody (which is different than nobody) trusts a shell script, which is what part of the program is written in, and remember, Postfix, which is somebody is certainly part of the group of nobody that doesn't trust a shell script.

And if you can follow that logic, then you could have probably fixed the problem faster than I did, which consisted of putting both Spring and Apache as honorary members of nobody (the group, of which nobody is already a member) so that's at least one thing Spring, Apache and Postfix can agree on.

Now, the reason we're mucking about with the email interface is for the upcoming Blogathon. Spring wants the ability to email entries as she might have an easier time getting email access than web access for some of her planned activities.

Well, now that everything is sorted out, I'll return you to your regularly scheduled Spring …


Thanks, sweetie face. *kisses*
Spring
- Thursday, July 24, 2003 at 04:55:57 (EDT)

Yup, that's about the solution I'd have expected except that I'd have set postfix to run as user postfix (which is the postfix default) then had users www, postfix, and spring all in a group (we'll call it silliness for example purposes). The only reason to separate out user nobody is in case anything else on the system uses that user/group. This keeps it so that only what you want can access the files.
azagthoth
- Tuesday, July 29, 2003 at 05:12:03 (EDT)


*Name:
Email:
URL:
*Comment:
previous masterlist next
about
all journals
wishlist
springdew.com
mimosa wisdom || explodinggoat || joyfulnoize
email me

 

What the LiveJournal peeps (including me) are up to: