Delay execution of deploy:set_permissions:* about symfony

[kingcrunch]

You should either use acl or run all commands as the webserver user. The problem is, that there are bundles out there, that still writes into app/cache on it's own, so even if this fixes your current issue, it doesn't prevent you from future ones.

But somehow I agree: As long as its supported, it should at least work 😄

[patrickli]

Yes I actually realized that after reporting this one. I went back and looked at the capistrano2 (capifony) deploy scripts used in some old projects. I was actually executing everything as root and then chown the current release to the owner user.

I think the better way is to configure php-fpm to run as the owner user. That's probably more secure as well.

[kingcrunch]

@patrickli Well, still the best way is to use acl 😉 Problem with making the php5-fpm-processes the same user as the checkout is, that now php5-fpm is able to write to the source files as well, which makes it theoretically possble (depending on the application), that some attacker can inject malicious code into the sources directly.

[patrickli]

OK. Thanks for the tip.

[peterjmit]

Closing - this is something better fixed by server management or a custom task (or using the in-built ACL). Running ACL after cache:warmup could potentially require sudo which I would like to avoid (as the support isn't great in capistrano)