Symfony 3.4 deployer fails due to permission denied of shared folder
up vote
0
down vote
favorite
I have developed a webapp based on Symfony3.4. On production it is deployed on a Ubuntu 18.04 Server via deployer (deployer.org).
Everything runs fine so far. The webapp is deployed in /opt/app/prod done by a user that is part of group www-data.
My webapp allows the upload of files. To support this I have added the folder data which stores the uploaded files.
In order to sustain access to the files after another release I have added the data folder to the list of shared folders.
My deploy.php looks as follows:
set('bin_dir', 'bin');
// Symfony console bin
set('bin/console', function () {
return sprintf('{{release_path}}/%s/console', trim(get('bin_dir'), '/'));
});
// Project name
set('application', 'appname');
set('http_user', 'www-data');
set('writable_mode', 'acl');
// Project repository
set('repository', '<MY_GITREPO>');
// [Optional] Allocate tty for git clone. Default value is false.
set('git_tty', true);
// Shared files/dirs between deploys
add('shared_files', );
add('shared_dirs', ['data']);
// Writable dirs by web server
add('writable_dirs', ['{{release_path}}','data']);
// Hosts
host('prod')
->hostname('<MY_HOST>')
->user('<MY_USER>')
->stage('prod')
->set('deploy_path', '/opt/app/prod/<MY_APPNAME>');
This leads to the following folder structure:
.
├── current -> releases/5
├── releases
│ ├── 2
│ ├── 3
│ ├── 4
│ └── 5
└── shared
├── app
└── data
So everything fine so far - with one exception:
Deployer wants to setfacl the data folder which is not allowed as the files in data belongs to www-data:www-data where deployer tries to change this as .
The command "export SYMFONY_ENV='prod'; cd /opt/app/prod/<MY_APPNAME>/releases/5 && (setfacl -RL -m u:"www-data":rwX -m u:`whoami`:rwX /opt/app/prod/<MY_APPNAME>/releases/5)" failed.
setfacl: /opt/app/prod/<MY_APPNAME>/releases/5/data/child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg: Operation not permitted
I have the impression that I did a mistake in my deployer.php or I missed something.
Has someone an idea what I need to do in order to get my deployment running?
Thanks and best regards
symfony deployment permissions
add a comment |
up vote
0
down vote
favorite
I have developed a webapp based on Symfony3.4. On production it is deployed on a Ubuntu 18.04 Server via deployer (deployer.org).
Everything runs fine so far. The webapp is deployed in /opt/app/prod done by a user that is part of group www-data.
My webapp allows the upload of files. To support this I have added the folder data which stores the uploaded files.
In order to sustain access to the files after another release I have added the data folder to the list of shared folders.
My deploy.php looks as follows:
set('bin_dir', 'bin');
// Symfony console bin
set('bin/console', function () {
return sprintf('{{release_path}}/%s/console', trim(get('bin_dir'), '/'));
});
// Project name
set('application', 'appname');
set('http_user', 'www-data');
set('writable_mode', 'acl');
// Project repository
set('repository', '<MY_GITREPO>');
// [Optional] Allocate tty for git clone. Default value is false.
set('git_tty', true);
// Shared files/dirs between deploys
add('shared_files', );
add('shared_dirs', ['data']);
// Writable dirs by web server
add('writable_dirs', ['{{release_path}}','data']);
// Hosts
host('prod')
->hostname('<MY_HOST>')
->user('<MY_USER>')
->stage('prod')
->set('deploy_path', '/opt/app/prod/<MY_APPNAME>');
This leads to the following folder structure:
.
├── current -> releases/5
├── releases
│ ├── 2
│ ├── 3
│ ├── 4
│ └── 5
└── shared
├── app
└── data
So everything fine so far - with one exception:
Deployer wants to setfacl the data folder which is not allowed as the files in data belongs to www-data:www-data where deployer tries to change this as .
The command "export SYMFONY_ENV='prod'; cd /opt/app/prod/<MY_APPNAME>/releases/5 && (setfacl -RL -m u:"www-data":rwX -m u:`whoami`:rwX /opt/app/prod/<MY_APPNAME>/releases/5)" failed.
setfacl: /opt/app/prod/<MY_APPNAME>/releases/5/data/child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg: Operation not permitted
I have the impression that I did a mistake in my deployer.php or I missed something.
Has someone an idea what I need to do in order to get my deployment running?
Thanks and best regards
symfony deployment permissions
Just to get this right./opt/app/prod/<app>/releases
is owned bywww-data:www-data
and group-writeable, you're deploying as a different useruser-x
who is member ofwww-data
and the commandsetfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in theshared/data
folder and especially the filechild/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned bywww-data:www-data
?
– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I have developed a webapp based on Symfony3.4. On production it is deployed on a Ubuntu 18.04 Server via deployer (deployer.org).
Everything runs fine so far. The webapp is deployed in /opt/app/prod done by a user that is part of group www-data.
My webapp allows the upload of files. To support this I have added the folder data which stores the uploaded files.
In order to sustain access to the files after another release I have added the data folder to the list of shared folders.
My deploy.php looks as follows:
set('bin_dir', 'bin');
// Symfony console bin
set('bin/console', function () {
return sprintf('{{release_path}}/%s/console', trim(get('bin_dir'), '/'));
});
// Project name
set('application', 'appname');
set('http_user', 'www-data');
set('writable_mode', 'acl');
// Project repository
set('repository', '<MY_GITREPO>');
// [Optional] Allocate tty for git clone. Default value is false.
set('git_tty', true);
// Shared files/dirs between deploys
add('shared_files', );
add('shared_dirs', ['data']);
// Writable dirs by web server
add('writable_dirs', ['{{release_path}}','data']);
// Hosts
host('prod')
->hostname('<MY_HOST>')
->user('<MY_USER>')
->stage('prod')
->set('deploy_path', '/opt/app/prod/<MY_APPNAME>');
This leads to the following folder structure:
.
├── current -> releases/5
├── releases
│ ├── 2
│ ├── 3
│ ├── 4
│ └── 5
└── shared
├── app
└── data
So everything fine so far - with one exception:
Deployer wants to setfacl the data folder which is not allowed as the files in data belongs to www-data:www-data where deployer tries to change this as .
The command "export SYMFONY_ENV='prod'; cd /opt/app/prod/<MY_APPNAME>/releases/5 && (setfacl -RL -m u:"www-data":rwX -m u:`whoami`:rwX /opt/app/prod/<MY_APPNAME>/releases/5)" failed.
setfacl: /opt/app/prod/<MY_APPNAME>/releases/5/data/child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg: Operation not permitted
I have the impression that I did a mistake in my deployer.php or I missed something.
Has someone an idea what I need to do in order to get my deployment running?
Thanks and best regards
symfony deployment permissions
I have developed a webapp based on Symfony3.4. On production it is deployed on a Ubuntu 18.04 Server via deployer (deployer.org).
Everything runs fine so far. The webapp is deployed in /opt/app/prod done by a user that is part of group www-data.
My webapp allows the upload of files. To support this I have added the folder data which stores the uploaded files.
In order to sustain access to the files after another release I have added the data folder to the list of shared folders.
My deploy.php looks as follows:
set('bin_dir', 'bin');
// Symfony console bin
set('bin/console', function () {
return sprintf('{{release_path}}/%s/console', trim(get('bin_dir'), '/'));
});
// Project name
set('application', 'appname');
set('http_user', 'www-data');
set('writable_mode', 'acl');
// Project repository
set('repository', '<MY_GITREPO>');
// [Optional] Allocate tty for git clone. Default value is false.
set('git_tty', true);
// Shared files/dirs between deploys
add('shared_files', );
add('shared_dirs', ['data']);
// Writable dirs by web server
add('writable_dirs', ['{{release_path}}','data']);
// Hosts
host('prod')
->hostname('<MY_HOST>')
->user('<MY_USER>')
->stage('prod')
->set('deploy_path', '/opt/app/prod/<MY_APPNAME>');
This leads to the following folder structure:
.
├── current -> releases/5
├── releases
│ ├── 2
│ ├── 3
│ ├── 4
│ └── 5
└── shared
├── app
└── data
So everything fine so far - with one exception:
Deployer wants to setfacl the data folder which is not allowed as the files in data belongs to www-data:www-data where deployer tries to change this as .
The command "export SYMFONY_ENV='prod'; cd /opt/app/prod/<MY_APPNAME>/releases/5 && (setfacl -RL -m u:"www-data":rwX -m u:`whoami`:rwX /opt/app/prod/<MY_APPNAME>/releases/5)" failed.
setfacl: /opt/app/prod/<MY_APPNAME>/releases/5/data/child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg: Operation not permitted
I have the impression that I did a mistake in my deployer.php or I missed something.
Has someone an idea what I need to do in order to get my deployment running?
Thanks and best regards
symfony deployment permissions
symfony deployment permissions
asked Nov 8 at 8:33
Oliver Koehler
2642315
2642315
Just to get this right./opt/app/prod/<app>/releases
is owned bywww-data:www-data
and group-writeable, you're deploying as a different useruser-x
who is member ofwww-data
and the commandsetfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in theshared/data
folder and especially the filechild/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned bywww-data:www-data
?
– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
add a comment |
Just to get this right./opt/app/prod/<app>/releases
is owned bywww-data:www-data
and group-writeable, you're deploying as a different useruser-x
who is member ofwww-data
and the commandsetfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in theshared/data
folder and especially the filechild/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned bywww-data:www-data
?
– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
Just to get this right.
/opt/app/prod/<app>/releases
is owned by www-data:www-data
and group-writeable, you're deploying as a different user user-x
who is member of www-data
and the command setfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in the shared/data
folder and especially the file child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned by www-data:www-data
?– nifr
Nov 8 at 9:25
Just to get this right.
/opt/app/prod/<app>/releases
is owned by www-data:www-data
and group-writeable, you're deploying as a different user user-x
who is member of www-data
and the command setfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in the shared/data
folder and especially the file child/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned by www-data:www-data
?– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53203994%2fsymfony-3-4-deployer-fails-due-to-permission-denied-of-shared-folder%23new-answer', 'question_page');
}
);
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Just to get this right.
/opt/app/prod/<app>/releases
is owned bywww-data:www-data
and group-writeable, you're deploying as a different useruser-x
who is member ofwww-data
and the commandsetfacl -RL -m u:"www-data":rwX -m u:user-x:rwX /opt/app/prod/<MY_APPNAME>/releases/5
fails? Can you confirm/double-check all files in theshared/data
folder and especially the filechild/679/ba7f9641061879554e5cafbd6a3a557b.jpeg
are owned bywww-data:www-data
?– nifr
Nov 8 at 9:25
No, /opt/app/prod/<app>/releases is owned by <MY_USER>:www-data but the given folder and all subfolder are group-writeable. And yes, I am trying to deploy as <MY_USER>. Just checked: All files in shared/data are owned by www-data:www-data as it has been created by the webserver.
– Oliver Koehler
Nov 8 at 11:10