Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to allow permissions to files on the /home/user1/public_html/ folder for both user1 and for www-data (apache).

I've been instructed to run these commands:

sudo chown -R www-data:user1 /home/user1/public_html/
sudo chmod g+s /home/user1/public_html/

Now, www-data does have access to edit/remove/add files to /home/user1/public_html/ but user1 cannot edit anything.

How can I solve this?

Thanks,

share|improve this question
    
What are the permissions currently? –  Shane Madden Dec 11 '11 at 20:41
    
@Shane Madden - drwxr-sr-x 2 www-data user1 4096 2011-12-11 09:15 public_html –  Or W Dec 11 '11 at 20:42
    
You have to be more specific. So you want user1 to be able to read & write folders and files under /home/user1/public_html/ - what permissions do you want Apache to have? read & write as well? (That's a bit of a security hole; better to make only the files/folders apache-writable that need to be, no more.) –  Ben Williams Feb 6 '12 at 4:48

5 Answers 5

You most likely have user1 and www-data the wrong way round in the commands in the question.

You don't want to give apache write permissions by default - and making the apache user the owner is going to do exactly that.

Try this:

sudo chown -R user1:www-data /home/user1/public_html/
sudo find /home/user1/public_html/ -type d -exec chmod 0755 {} \; -or -type f -exec chmod 0644 {} \;

That will make you the owner, and use the same group as apache, then reset permissions to 755 for folders and 644 for files. the 7 5 5 and 6 4 4 permissions are the ones that would apply to apache - only give apache write permissions to the folders it absolutely needs to write to.

share|improve this answer

If you did:

sudo chown -R www-data:user1 /home/user1/public_html/

You gave ownership to the user www-data and the group user1.

With:

sudo chmod g+s /home/user1/public_html/

You set the group ID on execution on this folder, I have never seen this done before and I have no idea why one would do this... It's usually used on binaries. You are messing things up with this. Unless you find a valid reason for doing it, reverse that:

sudo chmod g-s /home/user1/public_html/

And set read/write permissions fore both the user1 (which belongs to the group user1) and www-data.

sudo chmod -R 770 /home/user1/public_html

And now you have everyfile writable and readable by www-data and all users in the user1 group (which I assume only user1 is part of, double check it).

This is dirty since you may want some files to be writable only by the user. As a developer, it's not uncommon to "upload" files on the server instead of just editing them, this solves the right management issues by outsourcing it to a secure program as sftp/scp. You could even try to use a SCM.

share|improve this answer

The best way to achieve this is with posix ACLs. Standard unix file permissions dont really cut it. You can do it with some kludging but its not really more than a kludge, basically its not a straight-forward solution.

Using a ACL will resolve this issue succintly. To do this you can use the following commands:

setfacl -R -m www-user:rwx /home/user1/public_html
setfacl -R -d -m www-user:rwx /home/user1/public_html
setfacl -R -m user1:rwx /home/user1/public_html
setfacl -R -d -m user1:rwx /home/user1/public_html

The -d flag causes new files to inherit the ACLs you set in the directory.

There are some caveats to bear in mind.

  1. Your filesystem must support it (most do these days, they can be enabled by remounting the filesystem with ACL support on most filesystems). Stuff like NFS wont work.
  2. The standard Unix group ACL becomes a mask. I.E if a file says g+x the file is executable with the command above. if its g-x the file is not executable, regardless of whether or not permissions set are rwx in the ACL. This ensures you avoid a situation where you would have to mark all directories rwx in the acl and all files rw-.

This fixes a problem sensibly and permits various combinations of scenarios:

  • It enforces least privilege as you are not required to start modifying group memberships of users.
  • user1 can create a file which can be modified later by www1-user (so user1 can SFTP upload content which could be deleted and/or modified by a CMS in apache later) and visa versa.
  • Apache remains in a system account which avoids having to use SetUID workarounds to change the apache subject (user).
  • The modification applies within a specific directory structure only and wont inadvertently permit www-user or user1 access to other portions of the file system tree you would not wish them to access.
  • Altering or revoking permissions is a trivial change.

This is my preferred way to resolve these kind of issues. It is a simple, non-disruptive and trivial change.

share|improve this answer
2  
When setting the regular ACL, I prefer to use “rwX” over “rwx.” For example: setfacl -R -m www-user:rwX /home/user1/public_html. At least on Linux, this avoids marking all the files as executable. –  Michael Kropat Feb 6 '12 at 19:18

The simplest solution is to ensure that www-data can navigate all the directories to /home/user1/public_html directory and use 755 directory permissions from public_html and down. Files in the public_html directory need to be world (other) readable. These command should enable access:

sudo chmod o+x /home
sudo chmod 0+x /home/user1
find /home/user1/public_html -type d ! -perm -005 -print0 | xargs -0 sudo chmod o+rx
find /home/user1/public_html -type f ! -perm -004 -print0 | xargs -0 sudo chmod o+r

The first command is likely not required. Some systems restrict access to home directories fairly severely, and this is fixed by the second command. It does allow files to opened within the home directory, but does not grant the ability to list the directory.

The last three commands can be run by the user with sudo removed.

share|improve this answer

Apache doesn't need to write everywhere, for this you can specify tmp,upload,etc. folders. So you can set permissions for public_dir to be readable and executable by apache user:

sudo chown user1:www-data /home/user1/public_html
sudo chmod 0750 /home/user1/public_html

All other files under public_html dir can be under user1 permissions and only readable by "others" (apache here). This is also better from security view. As I wrote, only necessary files/folder should be writable by apache user.

share|improve this answer
    
that allows user1 to write to that folder, but www-data cannot write to the folder anymore now. –  Or W Dec 11 '11 at 21:50
1  
Yes, apache can't write to directory now but, as I wrote, it's better from security view. You can specify special directory where apache must write and it will be just apache dir (eg. uploads, images, tmp, i-dont-know. chown :www-data <some-dir>, chmod g+w <some-dir>). –  stderr Dec 12 '11 at 8:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.