Three of the problems of stock-api are about files, not about what is in them. Each needs one command, and each has a wrong fix that looks easy.
- /srv/stock-api
- current← a link to releases/v1.5.0, a release that is not complete
- logs← owned by root, so stock cannot write
- data
- stock.csv← rw-rw-rw-, any account can change it
The link
ls -l shows the target of a link. A link can point to a directory that exists, but is not a complete release. Compare the releases:
sh
cd /srv/stock-api
ls -l current
ls releases/*Move a link to a directory with ln -sfn, as in "Symbolic Links". The target is read from the directory of the link.
Who can write what
| Need | Check | Fix |
|---|---|---|
| The service writes in a directory | ls -ld (owner and w) | sudo chown to the system account |
| No other account changes a file | the last three permissions | sudo chmod o-w, or a number such as 640 |
| You change a file that you do not own | ls -l, id | Put sudo before the command |
The system account of the service is stock. The files that it reads and writes belong to it. The group deploy gets access where people need it. All other accounts get nothing.