Symfony 3.4 deployer fails due to permission denied of shared folder

Multi tool use
up vote
0
down vote
favorite
I have developed a webapp based on Symfony3.4. On production it is deployed on a Ubuntu 18.04 Server via deployer (deployer.org).
Everything runs fine so far. The webapp is deployed in /opt/app/prod done by a user that is part of group www-data.
My webapp allows the upload of files. To support this I have added the folder data which stores the uploaded files.
In order to sustain access to the files after another release I have added the data folder to the list of shared folders.
My deploy.php looks as follows:
set('bin_dir', 'bin');
// Symfony console bin
set('bin/console', function () {
return sprintf('{{release_path}}/%s/console', trim(get('bin_dir'), '/'));
});
// Project name
set('application', 'appname');
set('http_user', 'www-data');
set('writable_mode', 'acl');
// Project repository
set('repository', '<MY_GITREPO>');
// [Optional] Allocate tty for git clone. Default value is false.
set('git_tty', true);
// Shared files/dirs between deploys
add('shared_files', );
add('shared_dirs', ['data']);
// Writable dirs by web server
add('writable_dirs', ['{{release_path}}','data']);
// Hosts
host('prod')
->hostname('<MY_HOST>')
->user('<MY_USER>')
->stage('prod')
->set('deploy_path', '/opt/app/prod/<MY_APPNAME>');
This leads to the following folder structure:
.
├── current -> releases/5
├── releases
│ ├── 2
│ ├── 3
│ ├── 4
│ └── 5
└── shared
├── app
└── data
So everything fine so far - with one exception:
Deployer wants to setfacl the data folder which is not allowed as the files in data belongs to www-data:www-data where deployer tries to change this as .
The command "export SYMFONY_ENV='prod'; cd /opt/app/prod/<MY_APPNAME>/releases/5 && (setfacl -RL -m u:"www-data":rwX -m u:`whoami`:rwX /opt/app/prod/<MY_APPNAME>/releases/5)" failed.
setfacl: /opt/app/prod/<MY_APPNAME>/releases/5/data/child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg: Operation not permitted
I have the impression that I did a mistake in my deployer.php or I missed something.
Has someone an idea what I need to do in order to get my deployment running?
Thanks and best regards
symfony deployment permissions
add a comment |
up vote
0
down vote
favorite
I have developed a webapp based on Symfony3.4. On production it is deployed on a Ubuntu 18.04 Server via deployer (deployer.org).
Everything runs fine so far. The webapp is deployed in /opt/app/prod done by a user that is part of group www-data.
My webapp allows the upload of files. To support this I have added the folder data which stores the uploaded files.
In order to sustain access to the files after another release I have added the data folder to the list of shared folders.
My deploy.php looks as follows:
set('bin_dir', 'bin');
// Symfony console bin
set('bin/console', function () {
return sprintf('{{release_path}}/%s/console', trim(get('bin_dir'), '/'));
});
// Project name
set('application', 'appname');
set('http_user', 'www-data');
set('writable_mode', 'acl');
// Project repository
set('repository', '<MY_GITREPO>');
// [Optional] Allocate tty for git clone. Default value is false.
set('git_tty', true);
// Shared files/dirs between deploys
add('shared_files', );
add('shared_dirs', ['data']);
// Writable dirs by web server
add('writable_dirs', ['{{release_path}}','data']);
// Hosts
host('prod')
->hostname('<MY_HOST>')
->user('<MY_USER>')
->stage('prod')
->set('deploy_path', '/opt/app/prod/<MY_APPNAME>');
This leads to the following folder structure:
.
├── current -> releases/5
├── releases
│ ├── 2
│ ├── 3
│ ├── 4
│ └── 5
└── shared
├── app
└── data
So everything fine so far - with one exception:
Deployer wants to setfacl the data folder which is not allowed as the files in data belongs to www-data:www-data where deployer tries to change this as .
The command "export SYMFONY_ENV='prod'; cd /opt/app/prod/<MY_APPNAME>/releases/5 && (setfacl -RL -m u:"www-data":rwX -m u:`whoami`:rwX /opt/app/prod/<MY_APPNAME>/releases/5)" failed.
setfacl: /opt/app/prod/<MY_APPNAME>/releases/5/data/child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg: Operation not permitted
I have the impression that I did a mistake in my deployer.php or I missed something.
Has someone an idea what I need to do in order to get my deployment running?
Thanks and best regards
symfony deployment permissions
Just to get this right./opt/app/prod/<app>/releases
is owned bywww-data:www-data
and group-writeable, you're deploying as a different useruser-x
who is member ofwww-data
and the commandsetfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in theshared/data
folder and especially the filechild/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned bywww-data:www-data
?
– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I have developed a webapp based on Symfony3.4. On production it is deployed on a Ubuntu 18.04 Server via deployer (deployer.org).
Everything runs fine so far. The webapp is deployed in /opt/app/prod done by a user that is part of group www-data.
My webapp allows the upload of files. To support this I have added the folder data which stores the uploaded files.
In order to sustain access to the files after another release I have added the data folder to the list of shared folders.
My deploy.php looks as follows:
set('bin_dir', 'bin');
// Symfony console bin
set('bin/console', function () {
return sprintf('{{release_path}}/%s/console', trim(get('bin_dir'), '/'));
});
// Project name
set('application', 'appname');
set('http_user', 'www-data');
set('writable_mode', 'acl');
// Project repository
set('repository', '<MY_GITREPO>');
// [Optional] Allocate tty for git clone. Default value is false.
set('git_tty', true);
// Shared files/dirs between deploys
add('shared_files', );
add('shared_dirs', ['data']);
// Writable dirs by web server
add('writable_dirs', ['{{release_path}}','data']);
// Hosts
host('prod')
->hostname('<MY_HOST>')
->user('<MY_USER>')
->stage('prod')
->set('deploy_path', '/opt/app/prod/<MY_APPNAME>');
This leads to the following folder structure:
.
├── current -> releases/5
├── releases
│ ├── 2
│ ├── 3
│ ├── 4
│ └── 5
└── shared
├── app
└── data
So everything fine so far - with one exception:
Deployer wants to setfacl the data folder which is not allowed as the files in data belongs to www-data:www-data where deployer tries to change this as .
The command "export SYMFONY_ENV='prod'; cd /opt/app/prod/<MY_APPNAME>/releases/5 && (setfacl -RL -m u:"www-data":rwX -m u:`whoami`:rwX /opt/app/prod/<MY_APPNAME>/releases/5)" failed.
setfacl: /opt/app/prod/<MY_APPNAME>/releases/5/data/child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg: Operation not permitted
I have the impression that I did a mistake in my deployer.php or I missed something.
Has someone an idea what I need to do in order to get my deployment running?
Thanks and best regards
symfony deployment permissions
I have developed a webapp based on Symfony3.4. On production it is deployed on a Ubuntu 18.04 Server via deployer (deployer.org).
Everything runs fine so far. The webapp is deployed in /opt/app/prod done by a user that is part of group www-data.
My webapp allows the upload of files. To support this I have added the folder data which stores the uploaded files.
In order to sustain access to the files after another release I have added the data folder to the list of shared folders.
My deploy.php looks as follows:
set('bin_dir', 'bin');
// Symfony console bin
set('bin/console', function () {
return sprintf('{{release_path}}/%s/console', trim(get('bin_dir'), '/'));
});
// Project name
set('application', 'appname');
set('http_user', 'www-data');
set('writable_mode', 'acl');
// Project repository
set('repository', '<MY_GITREPO>');
// [Optional] Allocate tty for git clone. Default value is false.
set('git_tty', true);
// Shared files/dirs between deploys
add('shared_files', );
add('shared_dirs', ['data']);
// Writable dirs by web server
add('writable_dirs', ['{{release_path}}','data']);
// Hosts
host('prod')
->hostname('<MY_HOST>')
->user('<MY_USER>')
->stage('prod')
->set('deploy_path', '/opt/app/prod/<MY_APPNAME>');
This leads to the following folder structure:
.
├── current -> releases/5
├── releases
│ ├── 2
│ ├── 3
│ ├── 4
│ └── 5
└── shared
├── app
└── data
So everything fine so far - with one exception:
Deployer wants to setfacl the data folder which is not allowed as the files in data belongs to www-data:www-data where deployer tries to change this as .
The command "export SYMFONY_ENV='prod'; cd /opt/app/prod/<MY_APPNAME>/releases/5 && (setfacl -RL -m u:"www-data":rwX -m u:`whoami`:rwX /opt/app/prod/<MY_APPNAME>/releases/5)" failed.
setfacl: /opt/app/prod/<MY_APPNAME>/releases/5/data/child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg: Operation not permitted
I have the impression that I did a mistake in my deployer.php or I missed something.
Has someone an idea what I need to do in order to get my deployment running?
Thanks and best regards
symfony deployment permissions
symfony deployment permissions
asked Nov 8 at 8:33
Oliver Koehler
2642315
2642315
Just to get this right./opt/app/prod/<app>/releases
is owned bywww-data:www-data
and group-writeable, you're deploying as a different useruser-x
who is member ofwww-data
and the commandsetfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in theshared/data
folder and especially the filechild/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned bywww-data:www-data
?
– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
add a comment |
Just to get this right./opt/app/prod/<app>/releases
is owned bywww-data:www-data
and group-writeable, you're deploying as a different useruser-x
who is member ofwww-data
and the commandsetfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in theshared/data
folder and especially the filechild/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned bywww-data:www-data
?
– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
Just to get this right.
/opt/app/prod/<app>/releases
is owned by www-data:www-data
and group-writeable, you're deploying as a different user user-x
who is member of www-data
and the command setfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in the shared/data
folder and especially the file child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned by www-data:www-data
?– nifr
Nov 8 at 9:25
Just to get this right.
/opt/app/prod/<app>/releases
is owned by www-data:www-data
and group-writeable, you're deploying as a different user user-x
who is member of www-data
and the command setfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in the shared/data
folder and especially the file child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned by www-data:www-data
?– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53203994%2fsymfony-3-4-deployer-fails-due-to-permission-denied-of-shared-folder%23new-answer', 'question_page');
}
);
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
whBefvWtsRRnP3GS7 oaTw8srOi ajtNJ34gkxEgZ5ROm,mJagf
Just to get this right.
/opt/app/prod/<app>/releases
is owned bywww-data:www-data
and group-writeable, you're deploying as a different useruser-x
who is member ofwww-data
and the commandsetfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in theshared/data
folder and especially the filechild/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned bywww-data:www-data
?– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10