0

I have a bit of an odd set up, I think. I have groups for each domain my server hosts, and I add the user http to each domain group along with the users that should have access to the groups' domains. In my php script running from a directory 'public_html', I try creating a file:

<?php
$output = "";
print exec('touch test 2>&1', $output);

But I get

touch: cannot touch `test': Permission denied

and the file is not created. But here, clearly stated, the group has all permissions on the directory:

drwxrwxr-x 5 dwieeb example.com 1024 Feb  4 05:19 public_html

And here are the permissions on the php file in public_html that is trying to use the exec function:

-rw-rw-r-- 1 dwieeb example.com   59 Feb  4 05:19 test.php

How is this possible if http is part of the example.com group (as seen from a cat on /etc/group) and the directory has full permissions for the group? ...

example.com:x:1000:dwieeb,http

I'm stumped.

EDIT (since apparently I'm not cool enough to answer my own questions yet):

Ah, I found the problem. Yes, I restarted Nginx, but the php-fpm daemon must be restarted as well when http is added to the group for my domain.

On Arch Linux:

rc.d restart php-fpm

3 Answers 3

0

A number of possibilities, in rough order of probability:

  • You might not have restarted the web server, so it hasn't picked up the group change;
  • You've got too many groups on the web server user (there is a static limit to the number of groups that a user can be a member of)
  • There could be ACLs or selinux limitations on the operation.

For these and so many other reasons, don't have your webserver run dynamic code. At the very least, use suPHP (or suexec, in the general case) to run your dynamic code as the relevant user. Running a real appserver behind the scenes is even better for performance.

4
  • AFAIK suexec doesn't play well with nginx; php-fpm does though, and also supports spawning multiple PHP processes with different user/group ID settings
    – Shish
    Feb 5, 2012 at 5:23
  • I've restarted the web server multiple times. The web server user is currently only a member of http and example.com, (I'm setting up the server still). I don't know what ACLs are and I don't have selinux installed. It's pretty much vanilla Arch Linux + Nginx. I don't have my http user run console commands, I need it to work for file_put_contents(), which gives the same permission error messages. I figured I'd try it with a simple command through exec() to simplify the problem.
    – dwieeb
    Feb 5, 2012 at 5:28
  • @Shish: Of course suexec won't "play well" with nginx, since it's an Apache-only feature that isn't necessary with nginx because nginx never runs content as part of the webserver. If the OP isn't going to put diagnostically useful information in the body of the question, nor provide an appropriate title, they're not going to get the most useful answers.
    – womble
    Feb 5, 2012 at 8:14
  • On Linux, there is no static limit to the number of secondary groups a user can be a member of. There is a limit on FreeBSD and some other BSD nixen, but Linux is not one of them.
    – swelljoe
    Aug 7, 2014 at 2:34
0

Restart the php-daemon:

rc.d restart php-fpm

(just so you can close this case)

0

Typically you do not want the http user able to write or execute anything. This is a HUGE security issue in some environments.

I too have had php code that needed to be able to write to a specific directory in the public_html structure however. File System ACLs can accomplish this with ease. check out setfacl command. https://linux.die.net/man/1/setfacl

You can use something similar to this in your environment (however adjusting for your needs) #setfacl -Rm u:httpd:rw /var/httpd/public_html/upload With many LAMP based CMSs, it wants a directory to permit users to upload content or somesuch. This is what I've done in the past to allow the user the webserver runs as to write that directory. You may also use file system ACL to grant specific users and/or groups to have additional permissions on specific directories. I.E. giving a developer's user account access to public_html, or the developer group access.

It is pretty nifty functionality when you just need more fine-grained control over user and file/directory permissions than what chmod or chgrp can offer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .