diff --git a/changelogs/unreleased/5090.yml b/changelogs/unreleased/5090.yml new file mode 100644 index 0000000000000000000000000000000000000000..cccc737432c38cb529415f5291c930ce5557f2fe_Y2hhbmdlbG9ncy91bnJlbGVhc2VkLzUwOTAueW1s --- /dev/null +++ b/changelogs/unreleased/5090.yml @@ -0,0 +1,5 @@ +--- +title: Explicitly set group for GitLab data directories +merge_request: 5090 +author: Ben Bodenmiller (@bbodenmiller) +type: other diff --git a/doc/settings/configuration.md b/doc/settings/configuration.md index 9fd46b304f402fe9bea435714a759fd73e24dac1_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ=..cccc737432c38cb529415f5291c930ce5557f2fe_ZG9jL3NldHRpbmdzL2NvbmZpZ3VyYXRpb24ubWQ= 100644 --- a/doc/settings/configuration.md +++ b/doc/settings/configuration.md @@ -512,6 +512,6 @@ | Default location | Permissions | Ownership | Purpose | |--------------------------------------------------------|-------------|------------------|---------| -| `/var/opt/gitlab/git-data` | `0700` | `git` | Holds repositories directory | +| `/var/opt/gitlab/git-data` | `0700` | `git:git` | Holds repositories directory | | `/var/opt/gitlab/git-data/repositories` | `2770` | `git:git` | Holds Git repositories | | `/var/opt/gitlab/gitlab-rails/shared` | `0751` | `git:gitlab-www` | Holds large object directories | @@ -516,9 +516,9 @@ | `/var/opt/gitlab/git-data/repositories` | `2770` | `git:git` | Holds Git repositories | | `/var/opt/gitlab/gitlab-rails/shared` | `0751` | `git:gitlab-www` | Holds large object directories | -| `/var/opt/gitlab/gitlab-rails/shared/artifacts` | `0700` | `git` | Holds CI artifacts | -| `/var/opt/gitlab/gitlab-rails/shared/external-diffs` | `0700` | `git` | Holds external merge request diffs | -| `/var/opt/gitlab/gitlab-rails/shared/lfs-objects` | `0700` | `git` | Holds LFS objects | -| `/var/opt/gitlab/gitlab-rails/shared/packages` | `0700` | `git` | Holds package repository | -| `/var/opt/gitlab/gitlab-rails/shared/dependency_proxy` | `0700` | `git` | Holds dependency proxy | -| `/var/opt/gitlab/gitlab-rails/shared/terraform_state` | `0700` | `git` | Holds terraform state | +| `/var/opt/gitlab/gitlab-rails/shared/artifacts` | `0700` | `git:git` | Holds CI artifacts | +| `/var/opt/gitlab/gitlab-rails/shared/external-diffs` | `0700` | `git:git` | Holds external merge request diffs | +| `/var/opt/gitlab/gitlab-rails/shared/lfs-objects` | `0700` | `git:git` | Holds LFS objects | +| `/var/opt/gitlab/gitlab-rails/shared/packages` | `0700` | `git:git` | Holds package repository | +| `/var/opt/gitlab/gitlab-rails/shared/dependency_proxy` | `0700` | `git:git` | Holds dependency proxy | +| `/var/opt/gitlab/gitlab-rails/shared/terraform_state` | `0700` | `git:git` | Holds terraform state | | `/var/opt/gitlab/gitlab-rails/shared/pages` | `0750` | `git:gitlab-www` | Holds user pages | @@ -524,6 +524,6 @@ | `/var/opt/gitlab/gitlab-rails/shared/pages` | `0750` | `git:gitlab-www` | Holds user pages | -| `/var/opt/gitlab/gitlab-rails/uploads` | `0700` | `git` | Holds user attachments | -| `/var/opt/gitlab/gitlab-ci/builds` | `0700` | `git` | Holds CI build logs | +| `/var/opt/gitlab/gitlab-rails/uploads` | `0700` | `git:git` | Holds user attachments | +| `/var/opt/gitlab/gitlab-ci/builds` | `0700` | `git:git` | Holds CI build logs | | `/var/opt/gitlab/.ssh` | `0700` | `git:git` | Holds authorized keys | ## Only start Omnibus GitLab services after a given file system is mounted diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb index 9fd46b304f402fe9bea435714a759fd73e24dac1_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI=..cccc737432c38cb529415f5291c930ce5557f2fe_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI= 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb @@ -46,6 +46,7 @@ Mash.new(Gitlab['git_data_dirs']).each do |_name, git_data_directory| storage_directory git_data_directory['path'] do owner gitlab_user + group gitlab_group mode "0700" end end @@ -78,9 +79,10 @@ ].compact.each do |dir_name| storage_directory dir_name do owner gitlab_user + group gitlab_group mode '0700' end end storage_directory gitlab_rails_uploads_storage_path do owner gitlab_user @@ -81,9 +83,10 @@ mode '0700' end end storage_directory gitlab_rails_uploads_storage_path do owner gitlab_user + group gitlab_group mode '0700' only_if { gitlab_rails_uploads_storage_path != GitlabRails.public_path } end diff --git a/spec/chef/recipes/gitlab-rails_spec.rb b/spec/chef/recipes/gitlab-rails_spec.rb index 9fd46b304f402fe9bea435714a759fd73e24dac1_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLXJhaWxzX3NwZWMucmI=..cccc737432c38cb529415f5291c930ce5557f2fe_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLXJhaWxzX3NwZWMucmI= 100644 --- a/spec/chef/recipes/gitlab-rails_spec.rb +++ b/spec/chef/recipes/gitlab-rails_spec.rb @@ -111,7 +111,7 @@ end it 'does not create the ci builds directory' do - expect(chef_run).not_to run_ruby_block('directory resource: /tmp/uploads_storage') + expect(chef_run).not_to run_ruby_block('directory resource: /tmp/builds') end it 'does not create the uploads storage directory' do @@ -137,7 +137,7 @@ end it 'creates the git-data directory' do - expect(chef_run).to create_storage_directory('/tmp/git-data').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/git-data').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the repositories directory' do @@ -149,7 +149,7 @@ end it 'creates the artifacts directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/artifacts').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/artifacts').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the external-diffs directory' do @@ -153,7 +153,7 @@ end it 'creates the external-diffs directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/external-diffs').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/external-diffs').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the lfs storage directory' do @@ -157,7 +157,7 @@ end it 'creates the lfs storage directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/lfs-objects').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/lfs-objects').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the packages directory' do @@ -161,7 +161,7 @@ end it 'creates the packages directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/packages').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/packages').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the dependency_proxy directory' do @@ -165,7 +165,7 @@ end it 'creates the dependency_proxy directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/dependency_proxy').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/dependency_proxy').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the terraform_state directory' do @@ -169,7 +169,7 @@ end it 'creates the terraform_state directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/terraform_state').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/terraform_state').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the encrypted_settings directory' do @@ -173,7 +173,7 @@ end it 'creates the encrypted_settings directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/encrypted_settings').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/encrypted_settings').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the GitLab pages directory' do @@ -181,7 +181,7 @@ end it 'creates the shared tmp directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/tmp').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/tmp').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the shared cache directory' do @@ -185,7 +185,7 @@ end it 'creates the shared cache directory' do - expect(chef_run).to create_storage_directory('/tmp/shared/cache').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/shared/cache').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the uploads directory' do @@ -189,7 +189,7 @@ end it 'creates the uploads directory' do - expect(chef_run).to create_storage_directory('/tmp/uploads').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/uploads').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the ci builds directory' do @@ -193,7 +193,7 @@ end it 'creates the ci builds directory' do - expect(chef_run).to create_storage_directory('/tmp/builds').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/builds').with(owner: 'git', group: 'git', mode: '0700') end it 'creates the uploads storage directory' do @@ -197,7 +197,7 @@ end it 'creates the uploads storage directory' do - expect(chef_run).to create_storage_directory('/tmp/uploads_storage').with(owner: 'git', mode: '0700') + expect(chef_run).to create_storage_directory('/tmp/uploads_storage').with(owner: 'git', group: 'git', mode: '0700') end end