Take the 2-minute tour ×

I have a BitBucket account, and it will trigger a script on my sever that will pull and update the live server when a push is made. The trigger works, and after having a lot of troubles getting the _www user to trust the hgrc or whatever (I did get that working), it's actually doing the command.

The problem is I get an error about not being able to lock the folder, which means that my _www user doesn't have permission to the .hg folder.

What's a good way to approach this? I don't want to make the .hg folder 0777. I could put _www in the same group as my user (which I believe it is) and give the group rw (what is that, 0775?). Would that be acceptable, or are there other security implications I might be missing, or a better way to handle this.

I was I could run the command with my user. And maybe I can. BitBucket is using a POST service to post to my server and I do the command via PHP's shell_exec() (it only runs the command if the request came from BitBucket's IP).

[Update] I went ahead and tried setting the permissions to 0775, and it still didn't work (_www isn't in the same group as my user). Same error, which is:

abort: could not lock repository /path/to/local/repo: Permission denied

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

You've got the right idea with the groups stuff. You need to:

  • make sure the www user is in the same group as the group that owns everything in the .hg directory
  • make sure everything in the .hg directory is write-able by group (chmod -R g+w .hg)

If any other users besides www will be pushing/pulling/updating in that repo then you'll also want to use the sticky-group-bit to make sure that newly created files and directory have the same group ownership as the .hg directory itself.:

find .hg -type d | xargs chmod g+s
share|improve this answer
Groups still mess me up. The group that the _www user is in is _www. As root, what exactly do I run to make .hg recognize now and in the future the _www group as ok? I've never see g nor S, but like I said, I don't really ever have to mess with groups. –  CWSpear Oct 4 '12 at 18:10
You don't make .hg recognize _www is okay. You put the _www user into whatever group is the "group owner" of the .hg directory. Users can be in multiple groups and you add them with usermod. What is the current group ownership of your .hg directory? –  Ry4an Oct 4 '12 at 18:13
Owner is cameron and owner group is staff since I guess I was the one that hg cloned the repo. –  CWSpear Oct 4 '12 at 19:11
Capital S gave me an error, but from what I could find online, s is what I wanted, so I used that, and I think things are working. Thanks for your help! –  CWSpear Oct 4 '12 at 19:50
err, I had to do all of that stuff to the entire repo, and not just .hg –  CWSpear Oct 4 '12 at 19:55
show 1 more comment

Your first paragraph is not entirely clear, but have you tried changing the .hgrc file on the live server, adding:

users = _www
groups = _www
share|improve this answer
Sorry, I tried clarifying my first paragraph. It doesn't seem to be a trust issue (anymore), but a permissions issue. Which I COULD fix by just making everything 0777, but I don't want to do that. –  CWSpear Oct 4 '12 at 17:51
add comment

Your Answer


