Dennis Allison wrote:
which googling suggests is due to the protections of the var directory not having public write permissions set. My configuration vis a vis permissions is right out of the book
drwxr-xr-t 2 root root 4096 Oct 27 17:39 var
with zope running as a local user ( -u zope ).
The question, then, is "What should the permissions on var be?".
Whatever your system policy dicates it should be. What you have makes no sense though. Zope used to ship with a document detailing the proper ownership and permissions of the data directory, but that document was wildly incorrect (it describes something like what you have above). Unfortunately people seem all to happy to blindly follow instructions than to actually bother figuring out how unix filesystem permission really work. Step 1, is to make sure you're not running zope as root http://audible.transient.net/zope/#root Step 2, is to make a group for your zope instance, eg. "zope" Step 3, is to make a user for your zope instance, eg. "zope" with its primary group set to the group you've created in step 2 Step 4, is to set up the instance home, you should choose a partition intended for this kind of thing, on my systems I use /var/local/zope There are a bunch of silly default paths from here which I'll stick to only for the purposes of example, but don't feel tied to them. Consider this view of /var/local/zope: drwxr-xr-x 3 root staff 4096 Nov 1 14:32 . drwxrwsr-x 7 root staff 4096 Nov 4 01:07 .. drwxr-sr-x 2 root staff 4096 Aug 6 00:59 Extensions drwxr-sr-x 2 root staff 4096 Aug 6 00:59 Products drwxr-sr-x 2 root staff 4096 Sep 22 03:00 import drwxr-s--- 2 zope staff 4096 Oct 31 13:27 var This gives you a data directory ("var") that zope can write to, but keeps other users (apart from the superuser) out, unless they are part of the staff group (handy for admins to be able to debug stuff in there). If you're running zope as the "zope" user created earlier (directly, not via '-u' or other setuid misfeatures) this should give the process enough leeway to do what it needs to do with its data files and logs. Step 5, abandon all of the above and switch to zeo to get even further seperation, but I'll leave that for another discussion -- Jamie Heilman http://audible.transient.net/~jamie/