Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ubuntu server 11.10 with apache 2.2.20, php 5.3.6 and an installation of Joomla cms. I have used an extra hard disk as my web server storage and mounted it into /data/www/ (I hope it's not where my problem us!).

I've set permission of all files and folders in my web root to 755 and user groups for them is set to [default ubuntu user(in my case radio)]:www-data.

In past days I had serious problems with joomla not showing new uploaded images and other files and also I can't install any extensions. After hours of searching I found out that uploaded files don't have appropriate permission (they are -rw-------) and Joomla application cannot read, copy or move them after upload.

I’m wondering how can I set a default permission so all files that I upload use it?

PS: I’ve tested umask but it did nothing. I think it has nothing to do with my problem.

share|improve this question
1  
Did you plan on telling us how these uploads are happening? Or should we assume you are using UUCP over a 300 baud modem? –  Zoredache May 17 '12 at 22:17
    
I think I don't understand your question well! Uploading file are handled by joomla framework using http protocol an php handles my uploads. My server is on an esx virtual machine and it didn't had enough space, so I added more hard disk space to my vm and then I mounted this space (/dev/sda3) to /data/www. Apache document root also changed to /data/www and since then, I have problems with file-permissions. –  faridv May 17 '12 at 23:53
add comment

3 Answers

No idea about Joomla or the restrictions you may be dealing with on a VM, but how about something like:

sudo chown -R www-data:www-data /data/www
sudo chmod -R g+rws /data/www

That recursively sets the user:group to www-data:www-data using chown, and g+s part of the chown statement will ensure that files written by any permitted user maintain the owner's group (GUID). The r and w are the usual read and write permissions.

That's what I use on Ubuntu/Apache, but I believe that it's also possible to do the same with the user (SUID). Maybe someone else can chip in if I have the syntax wrong, but I believe something like:

sudo chown -R www-data:www-data /data/www
sudo chmod -R ug+rws /data/www

will set read/write for user and group only, and force files to have the www-data:www-data user:group.

However, read up on SUID and GUID, as by doing this you're granting other users the permissions of www-data. The other caveat is that if your drive is mounted with the nosuid flag set, none of this will work.

share|improve this answer
add comment

You mentioned that you tried umask and it didn't work but your problem sounds exactly like a umask one. Maybe you can revisit that?

There are two gotchas that you may have encountered that could have resulted in you thinking that umask wasn't the issue:

  • You need to change the umask of the user who is uploading the files, in most cases on your own server (rather than shared hosting) this will be the webserver user; www-data on Ubuntu.
  • You must change the umask for the user in the login scripts or in the apache startup script, simply running it while in a SSH session will not affect anything as it will only be active for that session.

Note that having group/world read permission on www-data owned files is bad - any other web app (so basically anything on the server) will be able to read things like config files with database passwords, etc. A better solution is mod_suexec but then you have to go configure PHP in CGI mode and Apache MPM worker, it's a bit more involved.

share|improve this answer
add comment

Have you tried ACL (Access Control Lists)? They allow files to be created to a specific file permission in a specific directory. I believe it is less global than something like umask which I believe is set on a global level (someone please correct me if I am wrong in the comments section below). Here is a link to an answer showing how to set the access control list in a directory http://stackoverflow.com/a/6550059/893659.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.