title: No access to file system by tomcat service (linux)
body: <p>I am running a webapplication with apache-tomcat-7.0.50. My applcication stores files uploaded by the user in a directory of the file system (./opt/data). When I manually start the server as root user with $CATALINA_HOME/bin/startup.sh I get access to the file system and all images are visible on my website. I do not want to execute tomcat as root as I think this might be a security issue and I automatically want to start tomcat when the server reboots. So I use a script to start the server as a service:</p>
  
  <pre><code>#!/bin/bash                                                                                                                                                                                                #                                                                                                                                                                                                          # tomcat7     This shell script takes care of starting and stopping Tomcat                                                                                                                                 
  # Description: This shell script takes care of starting and stopping Tomcat
  # chkconfig: - 80 20
  #
  ## Source function library.
  #. /etc/rc.d/init.d/functions
  TOMCAT_HOME=/home/peter/tomcat
  SHUTDOWN_WAIT=20
  
  tomcat_pid() {
    echo `ps aux | grep org.apache.catalina.startup.Bootstrap | grep -v grep | awk '{ print $2 }'`
  }
  
  start() {
    pid=$(tomcat_pid)
    if [ -n "$pid" ] 
    then
      echo "Tomcat is already running (pid: $pid)"
    else
      # Start tomcat
      echo "Starting tomcat"
      ulimit -n 100000
      umask 007
      /bin/su -p -s /bin/sh root $TOMCAT_HOME/bin/startup.sh
    fi
  
  
    return 0
  }
  
  stop() {
    pid=$(tomcat_pid)
    if [ -n "$pid" ]
    then
      echo "Stoping Tomcat"
      /bin/su -p -s /bin/sh root $TOMCAT_HOME/bin/shutdown.sh
  
      let kwait=$SHUTDOWN_WAIT
      count=0;
      until [ `ps -p $pid | grep -c $pid` = '0' ] || [ $count -gt $kwait ]
      do
        echo -n -e "\nwaiting for processes to exit";
        sleep 1
        let count=$count+1;
      done
  
      if [ $count -gt $kwait ]; then
        echo -n -e "\nkilling processes which didn't stop after $SHUTDOWN_WAIT seconds"
        kill -9 $pid
      fi
    else
      echo "Tomcat is not running"
    fi
  
    return 0
  }
  
  case $1 in
  start)
    start
  ;; 
  stop)   
    stop
  ;; 
  restart)
    stop
    start
  ;;
  status)
    pid=$(tomcat_pid)
    if [ -n "$pid" ]
    then
      echo "Tomcat is running with pid: $pid"
    else
      echo "Tomcat is not running"
    fi
  ;; 
  esac
  exit 0
  </code></pre>
  
  <p>Unfortunatelly my images cannot be displayed on the website if I start tomcat as a service.</p>
  
  <p>I already gave the directory the following read / write / execute permission:</p>
  
  <p><code>drwxrwxrwx 2 root tomandruser     12288 Jan 21 21:09 data</code></p>
  
  <p>The user roup tomandruser:</p>
  
  <pre><code>[root@s17139702 init.d]# groups root
  root : root tomandruser
  [root@s17139702 init.d]# groups tomcat
  tomcat : tomcat tomandruser
  [root@s17139702 init.d]#
  </code></pre>
  
  <p>How can I specify which user runs the tomcat service and how can I get him access to the /opt/data directory so that my server can load the images?</p>
  
  <p>Thanks for helping me out.</p>
  
  <p>Update result ps -aef | grep java</p>
  
  <p>started as service:</p>
  
  <pre><code>[root@s17139702 init.d]# ps -aef | grep java
  root     28898     1  2 14:21 pts/0    00:01:01 /usr/bin/java -Djava.util.logging.config.file=/opt/apache-tomcat-7.0.50/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Djava.endorsed.dirs=/opt/apache-tomcat-7.0.50/endorsed -classpath /opt/apache-tomcat-7.0.50/bin/bootstrap.jar:/opt/apache-tomcat-7.0.50/bin/tomcat-juli.jar -Dcatalina.base=/opt/apache-tomcat-7.0.50 -Dcatalina.home=/opt/apache-tomcat-7.0.50 -Djava.io.tmpdir=/opt/apache-tomcat-7.0.50/temp org.apache.catalina.startup.Bootstrap start
  root     29066 28724  0 14:58 pts/0    00:00:00 grep java
  </code></pre>
  
  <p>started manually:</p>
  
  <pre><code>[root@s17139702 bin]# ps -aef | grep java
  root     29147     1 99 14:59 pts/0    00:00:11 /usr/bin/java -Djava.util.logging.config.file=/opt/apache-tomcat-7.0.50/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dfile.encoding=UTF-8 -Djava.endorsed.dirs=/opt/apache-tomcat-7.0.50/endorsed -classpath /opt/apache-tomcat-7.0.50/bin/bootstrap.jar:/opt/apache-tomcat-7.0.50/bin/tomcat-juli.jar -Dcatalina.base=/opt/apache-tomcat-7.0.50 -Dcatalina.home=/opt/apache-tomcat-7.0.50 -Djava.io.tmpdir=/opt/apache-tomcat-7.0.50/temp org.apache.catalina.startup.Bootstrap start
  root     29165 28724  0 14:59 pts/0    00:00:00 grep java
  </code></pre>
  
  <p>** Update II **</p>
  
  <p>Ok, I created the user updated the user permissions for the directories and subdirectories.</p>
  
  <pre><code>drwxr-xr-x 9 tomcatuser tomcatuser      4096 Jan 21 15:09 apache-tomcat-7.0.50
  drwxrwxrwx 2 tomcatuser tomcatuser     12288 Jan 21 21:09 data
  </code></pre>
  
  <p>I adjusted the start script:<br>
  before: <code>/bin/su -p -s /bin/sh root $TOMCAT_HOME/bin/startup.sh</code></p>
  
  <p>after:  <code>sudo -u tomcatuser /bin/sh $TOMCAT_HOME/bin/startup.sh</code> </p>
  
  <p>and call the service like so:</p>
  
  <pre><code>sudo service tomcat7 start
  </code></pre>
  
  <p>Still not displaying the images. Thanks for your help, I really appreciate that.</p>