Permissions in apps folder

General Discussion
1

I have more than one question.I’m curious to know if anybody has set up a good permissions schema for managing /var/www/ood/apps/sys/. Right now it’s default all owned root : root. On some apps we use group ownership to limit the visibility of some apps (for example a graduate class). But with root ownership that means if I want my graduate employees to update anything I have to give them sudo and I would like to avoid that if I can. They use the sandbox to work on everything, but I don’t always have the time to do all the deployments.

When a user is retired from our cluster they are removed from ldap, effectively orphaning all folders that have that uid as owner. We use a mounted home filesystem across the cluster. The user folders on the home filesystem are archived for up to a year, but it’s the non-user locations I’m interested in, like the PUN tmp dirs, /var/tmp/ondemand-nginx/%{user} (we also have /var/tmp/%{user} so I’m guessing this was changed?). I have folders going back to November of 2024. For the most part they are empty except for a few that contain session id’s. Some just have empty folders. Is there a good strategy for managing this location?

Managing /tmp/passenger.%{CRC} (example: passenger.RAb6gGa). These folders aren’t being cleaned out on reboot. I can’t find the nginx setting that defines this location. Again, the age of these folders go back to December of 2024. Is there a way to manage these?

Thanks, Kenny

2

We have a root script that does basically the following:

find /var/tmp/ondemand-nginx/ -nouser -delete
rmdir /var/tmp/ondemand-nginx/* 2>/dev/null

/tmp cleaning is at the mercy of systemd these days, and does not always occur across reboots, unless /tmp is RAM resident. /usr/lib/tmpfiles.d/tmp.conf controls how often things get cleared as I recall; see the tmpfiles.d man page for more info. That file will allow you some “delete at reboot” (R) capabilities.

Cheers, Ric

1 Like