1

The /var/www folder is owned by root root (user, group). Which means that www-data (apache/php group) doesn't have access. This was causing write errors because PHP was not allowed to create files.

I solved it by CHMOD 0777 the whole /var/www folder since it is just a private development machine. However, this still causes problems because CHMOD only works on the files that exist when it is run - not files created after. So if I would create a new file then PHP wouldn't be able to rwx it.

And now I'm using git to bring in more files and I'm having a pain trying to get apache/php, git, and my own user to all play nice with each other files.

How do I enable full access for all three of us?

3 Answers 3

1

Create a www or similar named group and add all the users you want to write to /var/www to that group. Then chown -R www-data:www the full /var/www directory. This should allow you the access you need.

Other than that just cleanup the 0777 privileges and reset them to normal.

I hope that works out :-)

3
  • The only users I see are root and myself - so wouldn't I need to change the group to be owned by www-data and add myself as a member to that group?
    – Xeoncross
    Feb 21, 2010 at 22:31
  • Ya if www-data is a group as well add them to that group, then chown -R www-data:www-data the /var/www directory.
    – Burton
    Feb 21, 2010 at 22:39
  • Actually, cat /etc/passwd is what I needed as it shows that dispite what the Ubuntu user GUI says - there are more users than just root and myself. Thanks!
    – Xeoncross
    Feb 22, 2010 at 19:37
4

chmod 777 is a bad habit, even if it's a private machine... learning how to do things right in a safe environment means you know how to do them when you need to do it in an unsafe environment. And you won't be tempted to release a production app with installation instructions that say "chmod -R 777 /var/www/myapp".

Burton's answer is what I do. My developer accounts are in group www-data, and www-data is the group set on all the files.

Look at 'man 2 chmod' and read what the group-sticky-bit does. It comes in very handy when you're primary group is not the group you want assigned to new files you create there. It will allow files you create to be automatically set to the www-data group in directories where you've set it.

If your webserver is not creating new files with wide enough permissions (it's creating 0755 when you want 0775), look at its umask setting.

For Perl CGI, I usually use suexec so that the CGI runs as a specific user instead of as www-data. As jdoss points out, you'll need a PHP-specific module for that. There's also an Apache2 mpm (prefork) that will allow each vhost to run as a specific user, even for regular reads. I haven't tried this one out yet, but if it works well, it would help a lot with this kind of security issue.

2
  • Thanks for the info on the "man 2 chmod". Keeping new files I create on that www-data group is important. However, I don't have the manual page for that entry so I guess I'll just have to change my default group to www-data until I figure out what I need to run. Also, it appears git runs as whatever user I am so I don't have to mess with it.
    – Xeoncross
    Feb 22, 2010 at 19:36
  • chmod g+s [dirname] Causes new files or directories to inherit the group of the parent directory. Doesn't affect existing files that you move into it, though. Feb 23, 2010 at 4:27
0

What you can do is setup an Apache vhost and docroot it into a dir inside of my user's home directory (/home/username/public_html). This allows your user and Git manipulate files without having to worry too much about permissions/ownership. From there you can either be lazy and change the Apache/PHP user to run as your user (I think this will work) or you can look into setting up SuPHP (http://www.suphp.org/Home.html) which will run your PHP scripts with the permissions of their owners.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .