Allow to sudo as the tb-release user on staticiforme for members of the tb-release group
When we release a new Tor Browser update we need to update some files in /srv/aus1-master.torproject.org/htdocs/torbrowser on staticiforme.tpo. As we are multiple people in the team publishing updates (members of the ldap group tb-release), we make the files there group-owned by tb-release and add write permission for group on the files.
However there are some problems with doing things like that:
- if one of us create files but forget to set write permission for the group, other members of the group cannot modify those files
- because permission on directories have the sticky bit, we cannot remove files from other users
I think it would be better if all files in /srv/aus1-master.torproject.org/htdocs/torbrowser are owned by the tb-release user, and we use sudo -s -u tb-release when we need to update files in this directory.
Currently running sudo -s -u tb-release tells me:
Sorry, user boklm is not allowed to execute '/bin/bash' as tb-release on staticiforme.torproject.org.
/cc @richard