Git prime/hub website deployment: documentroot changes save fine but permission denied for subdirectories

You need to add a wrapper to correct permissions on your post-update hook. Depending on how is your server setup, involves different steps. I'll describe my use case and hopefully you can adapt it to your needs.

In my server, the bare repositories (hub ones) are managed by gitosis/gitolite/plain git user with git-shell. Files under $GITOSIS_HOME are owned by gitosis:gitosis and are umasked 077.

For the changes to be pulled correctly, I needed to add a call to a helper script I'm storing in /usr/local/bin that recursively sets owner, group, permissions and SELinux context in the prime/live repository.

Incidentally, I also needed to add a line to my sudoers(5) file to allow gitosis to run the script as root with !requiretty and NOPASSWD.