Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It seems that Apache needs at least read and execute permission to all the sub-directories of a path in order to serve the files in the directory.

Does anyone have a script or one-liner that could verify this?

I was thinking perhaps a bash script that will su - apache and then attempt to navigate to each directory in the path. I'm going to try some things out and I'll post if I come up with something that works.

share|improve this question
add comment

4 Answers

up vote 6 down vote accepted

For Debian:

sudo -u www-data test -r /path/to/file && echo ok
share|improve this answer
    
Does this test fail if you do not have access to /path/to but have access to /path/to/file. This is what I'm trying to test. –  Belmin Fernandez Mar 4 '12 at 22:12
    
Outstanding. My tests show that it does exactly what I need! –  Belmin Fernandez Mar 4 '12 at 22:14
    
Please be aware that -r is for files only. If you need to know if Apache is capable of doing a DirectoryIndex on a folder, test -rx. /cc @conrad-shultz –  Luis Bruno Mar 4 '12 at 22:25
add comment

Consider:

#!/bin/bash
# testperms.sh

if [ -r $1 ];
   then echo "Can read file!";
else
   echo "Cannot read file!";
fi

Usage:

 shultzc@lithium:~$ ./testperms.sh /etc/ssl
 Can read file!
 shultzc@lithium:~$ ./testperms.sh /etc/ssl/private
 Cannot read file!

You should be able to adapt that code to your needs. In combination with sudo it can be used easily to test accessibility of files within directories with +x permissions only (such as many home directories), e.g.:

 shultzc@lithium:~$ sudo -u www-data ./testperms.sh /home/shultzc/testperms.sh
 Can read file!
 shultzc@lithium:~$ sudo -u www-data ./testperms.sh /home/shultzc
 Cannot read file!
share|improve this answer
    
sudo -u www-data test -r /path/to/file –  Luis Bruno Mar 4 '12 at 22:04
1  
@LuisBruno Ah, brilliant! –  Conrad Shultz Mar 4 '12 at 22:07
    
To be honest, I was going to use other flags for test, then I read your script and bitch-slapped myself. Anyway, both our scripts fail for the drwx-----x case. –  Luis Bruno Mar 4 '12 at 22:14
add comment

This is what I got (must be run as a user that could su - <test user>:

#!/bin/bash

IFS='/'
CWD='/'

for dir in $2; do

   # Set directory to test
   if [[ $CWD == '/' ]]
   then
      CWD="/$dir"
   else
      CWD="${CWD}/${dir}"
   fi

   # Test if user has access
   if !(su - $1 -c "cd $CWD" 2> /dev/null)
   then
      echo "$CWD - No access for $1"
      exit -1
   fi
done

echo "Access for $1 all the way through $2"
share|improve this answer
    
Way more complicated than required... :-) –  Conrad Shultz Mar 4 '12 at 21:58
    
Figured heh. That's why I came to SF. Seems like Luis beat us all on this one! –  Belmin Fernandez Mar 4 '12 at 22:14
add comment

The following find commands should be run as root, or at least a user that has full access to the directory tree. You will need an additional check to verify access to the paths used in the find commands. This can be accomplished by running the command as the target user. Failures when running as a non-root user should be dealt with appropriately.

Replace /srv/www with the appropriate directory or directories for your requirements. Change the user and group appropriately for other users. If the user belongs to multiple groups, you will need to add additional tests for the secondary groups. (In many cases just flagging files owned by the secondary groups may be sufficient.)

For a system where apache runs as www-data:www-data the following will find files which can't be read.

find /srv/www ! -type d ! \( -user www-data -perm -400 \) -a ! \( -group www-data -perm -040 \) -a ! -perm -004

The equivalent for accessible directories is:

find /srv/www -type d ! \( -user www-data -perm -500 \) -a ! \( -group www-data -perm -050 \) -a ! -perm -005

For directories that don't need to be listed use 1 instead of 5 in the above. Files with known names will be accessible, but auto-index generation won't be.

You may also want to ensure only a few files or directories can be written to. The following finds files and directories that can be written too.

find -L /srv/www \( -user www-data -perm -200 \) -o \( -group www-data -perm -020 \) -a -perm -002
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.