deploy:cleanup failing with permissions issue

[arderyp]

I have resolved a few other permissions issues by setting up sudoers rules (for chgrp and chmod commands, for example)

I am now having permissions issues with deploy:cleanup because some cache files (symfony) are owner by apache:apache. Some are even owned by root:root, oddly. I don't know if sudoers can handle this type of case, especially with security in mind. If I am wrong, please let me know. Otherwise, how else can I approach this? For example, I need my deploy user to be able to execute

rm -rf /path/to/releases/[0-9]+

Maybe you have an idea @antonmedv?

[arderyp]

@antonmedv

[antonmedv]

sudo rm -rf /path/to/releases/[0-9]+

[arderyp]

Thanks @antonmedv

Do you think adding that to the sudoers rules is safe and won't allow path traversal?

[arderyp]

it doesn't seem to work for me:

%myDeployGroup ALL= NOPASSWD: /usr/bin/rm -rf /path/to/releases/[0-9]+
%myDeployGroup ALL= NOPASSWD: /usr/bin/systemctl status httpd.service

The second line works but the first does not:

sudo /usr/bin/systemctl status httpd.service
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/httpd.service.d
           └─php-fpm.conf
   Active: active (running) since Sun 2024-02-18 03:30:06 PST; 8h ago
     Docs: man:httpd.service(8)
  Process: 8817 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful (code=exited, status=0/SUCCESS)
 Main PID: 9063 (httpd)
   Status: "Total requests: 15806; Idle/Busy workers 100/0;Requests/sec: 0.538; Bytes served/sec: 1.4KB/sec"
    Tasks: 278 (limit: 4618)
   Memory: 22.9M
   CGroup: /system.slice/httpd.service
           ├─9063 /usr/sbin/httpd -DFOREGROUND
           ├─9065 /usr/sbin/httpd -DFOREGROUND
           ├─9066 /usr/sbin/httpd -DFOREGROUND
           ├─9067 /usr/sbin/httpd -DFOREGROUND
           ├─9068 /usr/sbin/httpd -DFOREGROUND
           └─9455 /usr/sbin/httpd -DFOREGROUND

Feb 18 03:30:06 host systemd[1]: Starting The Apache HTTP Server...
Feb 18 03:30:06 host systemd[1]: Started The Apache HTTP Server.
Feb 18 03:30:06 host httpd[9063]: Server configured, listening on: port 443, port 80

sudo /usr/bin/rm -rf /path/to/releases/666

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for my-user: 
sudo: a password is required

[arderyp]

I was able to get around this with setfacl:

setfacl -Rdm u:MY-USER:rwx /path/to/releases
setfacl -Rm u:MY-USER:rwx /path/to/releases

should deployer/deployer/recipe/deploy/writable.php include logic to execute something similar for releases/. It looks like wirtable_dirs is only relevant to paths under a release. @antonmedv do you think I could use it with a relative path like ../releases?

[arderyp]

I see the thumbs up... does that mean you do think I can pass a relative path like ../releases to writable_dirs without issue?

On second thought, maybe it's a bad idea, as the writable logic give access to the deploying user and the webserver user, and it may be an arguably bad/insecure idea to give the webserver write access to the code under releases/