I'm working on a deployment script using GitLab that deploys some code to a Linux based server. I have a stage of deployment that needs to lock down permissions. What's the best approach for accomplishing this?

I need the following types of commands to run on a remote server and am currently struggling with permission issues as only root/sudoers are allowed to chown and chmod. The user that is used to connect to the server via SSH is part of the www-data group. The script fails on the chown command because the user is not root. Note: the gitlab-runner is not on the same machine as where code is going to be deployed.

chown -R www-data:www-data
find $REMOTE_BUILD_DIR -type f -exec chmod 644 {}
find $REMOTE_BUILD_DIR -type d -exec chmod 755 {}

I'm doing this manually but I am wondering if this can be done in an automated way.

  • Do I just give the ssh user sudo access? Which seems insecure.
  • Am I approaching this in the completely wrong way and there is a better way of doing this? Like using umask to set default permissions and ACL to give this user specific access needs?
  • Is there some way to go into sudo mode through a gitlab script?

Objectives are to securely deploy code to environment and make sure permissions are secure without having to manually do so.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy