Dev environment file permissions on Linux

Default Apache installations on Ubuntu runs as the user www-data, which is a restricted user account with access to /var/www and not much more. Local snippet development will normally take place under the user home directory. /var/www will not be accessible by the user and likewise, the user home directory will not be accessible to www-data.

As long as we are talking a development-only server, it would be possible to add the user to the www-data group without compromising security too much, but I would like to make it read-only access if possible. Currently, it seems like I have to load the entire MODx framework to use parseSchema(), which of course requires read/write access to the MODx directory. As far as I can tell, then the schema parsing process just needs to call some procedures, and does not need to modify cache etc. Is there a way around, so I can build the schema while having read-only access to the MODx installation?

Quote from: Jacob at Jan 31, 2010, 04:32 AM

Default Apache installations on Ubuntu runs as the user www-data, which is a restricted user account with access to /var/www and not much more. Local snippet development will normally take place under the user home directory. /var/www will not be accessible by the user and likewise, the user home directory will not be accessible to www-data.

As long as we are talking a development-only server, it would be possible to add the user to the www-data group without compromising security too much, but I would like to make it read-only access if possible. Currently, it seems like I have to load the entire MODx framework to use parseSchema(), which of course requires read/write access to the MODx directory. As far as I can tell, then the schema parsing process just needs to call some procedures, and does not need to modify cache etc. Is there a way around, so I can build the schema while having read-only access to the MODx installation?

You only need to be able to read the core files. Why aren’t you owner of the files, and www-data the group? Then with 775 and 664 (on development server anyway), you can work with all of it read/write anyway and make parts 755/644 that you don’t want writable by the web server.