Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a PHP script that creates a folder on my server. This folder is supposed to be accessed via Apache, and users can view it online.

Now if I create this folder while being root, everything works as it should, I can view the html/php when going on the website.

If I create this folder while being the user Apache (or running my script), I can create the folder, put all the files inside but when I got on my webpage, it displays:

You don't have permission to access / on this server.

Now I don't know that much about Apache, but for me the easiest solution is to give ownership of my folder to root. I try typing:

chown root:root /blabla/myfolder

and it writes:

chown: changing ownership of 'myfolder/': Operation not permitted

Why is that ?

Thank you

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You do not need to change owner and group to root on the folder nor you can. You can, however, give read permissions on group and other with:

chmod go+r foldername

Example:

yvaine:~ rilindo$ ls -la | grep test
drw-------    2 rilindo  staff        68 Dec  5 01:10 test
yvaine:~ rilindo$ chmod go+r test
yvaine:~ rilindo$ ls -la | grep test
drw-r--r--    2 rilindo  staff        68 Dec  5 01:10 test

However, if it is a empty folder, it is possible that directory browsering is disabled in Apache by default. In that case, you can add or modify someplace in your stanza:

Options +Indexes

Note that it is generally best practice to disable directory browsing unless there is a good reason for it.

share|improve this answer
    
1) The directory is not empty, that is not the problem. 2) I have already tried applying chmod 777 on the folder using apache, and the webserver still cannot display the folder. Same if I apply 777 to every file in the folder. Can it be something else ? –  xtrimsky Dec 5 '11 at 17:38
    
Then its the web server configuration, as I noted. Here is the more information this (httpd.apache.org/docs/1.3/misc/FAQ.html#indexes). Its Apache 1.3, but the configuration hasn't changed too much. If you need more information, here is another URL: besthostratings.com/articles/prevent-directory-listing.html –  Rilindo Dec 5 '11 at 17:53
    
ok thanks I'll check it out :) –  xtrimsky Dec 5 '11 at 17:59
1  
Oh I was watching the wrong error log... Found out this website has another error log. Now it says: Symbolic link not allowed or link target not accessible: /var/www/vhosts/***/httpdocs . Now that I have the error logs I'll be able to try a few more things thank you ! Will keep you updated in the next few hours. –  xtrimsky Dec 6 '11 at 0:20
1  
yes so one of my symbolic links was not made by apache. Thank you! –  xtrimsky Dec 6 '11 at 2:34

Others seem to be answering your implied question of "how do I fix that?", and doing a good job of it, so I thought I'd answer your actual question of "why is that?".

Disclaiming a file via chown, that is, chowning it to some other user, is forbidden to all non-root users for good reasons. Consider the following sequence:

cp /bin/bash ~/naughty

Now you have a copy of bash in your home directory. You own it. No big deal.

chmod 4755 ~/naughty

Now you have a copy of bash which can be run by anyone, and anyone who runs it will become you, because you have set the SUID bit on the binary, and you own the file. Not so good.

chown root:root ~/naughty

Congratulations, you just rooted your system; you have a copy of the shell which is SUID to root and can be run by anyone.

There are other reasons why the power to disclaim a file is bad, eg it messes with disc quotas if anyone can create a big file then give it to another user. But the killer reason is the one above, and the only way to plug that hole (without getting rid of SUID, which is a lovely idea but hard to do) is to say that noone who is not root may give a file to another user.

share|improve this answer
    
Thanks! Even thought technically the other answer is what I really need right now, I find it more important to understand why it is working this way to understand more the core of linux :) –  xtrimsky Dec 5 '11 at 17:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.