I'm not sure if it's a hook or not but I'll just try adding a chown command to my deploy function. I was already specifying user='www-data' on the pull but am not sure if that does anything.
def deploy(): sudo('cd /var/web2py/applications/%s; hg pull' % (app), user='www-data') sudo('cd /var/web2py/applications/%s; hg update' % (app)) sudo('chown -R www-data:www-data /var/web2py') sudo('/etc/init.d/cherokee restart')