0

Currently I have it set up such that users can download zip files from my site, and they're stored in /tmp/zip_file_dir/. The PHP script first downloads them from my CDN using ftp_get() and then places them in that folder such as /tmp/zip_file_dir/random_hash_folder/file_here.zip. Then I simply use readfile() to initiate the download for the user. That all works fine.

However, I then later use a cronjob to clear this folder out (the script deletes the downloads after readfile(), but if the user cancels the download script the files aren't deleted by it hence the point of the cronjob to clean these up).

The file_here.zip file has the permissions -rw-r--r-- with the owner apache. Each random_hash_folder in zip_file_dir has the permissions drwxr-xr-x with the owner apache. The cronjob simply scans the zip_file_dir and uses rmdir() and unlink() to delete the files.

The cronjob is run by a user with sudo access to the server (i.e. more permissions and abilities than the apache user). However, I keep getting PHP "Permission denied" notices when trying to delete the files.

I've tried added the sudo user running the cron job to the apache and nobody groups as mentioned elsewhere in some of my Google research, but that hasn't brought me any luck.

Any ideas how I get this cronjob to delete those files?

Edit: I am using RHEL.

2
  • 1
    That the user has sudo privileges does not mean they are necessarily acting with elevated privileges. Are you actually invoking sudo to perform the operations that require elevated privileges?
    – womble
    Jul 9, 2012 at 16:36
  • No, I know I'm not using the sudo privileges. I said that more as a way to let you guys know that I do have the ability to get the right privileges somehow but that I haven't been able to figure it out.
    – joshholat
    Jul 9, 2012 at 16:46

2 Answers 2

2

You don't need any more permissions and abilities than the Apache user. Since the apache user created those files, the apache user can destroy them. The apache user seems like the most appropriate user to me.

You can either put your cron job in the apache user's crontab ( sudo crontab -u apache -e) or run the job from root's crontab as the apache user:

1 5 * * * su apache -c "/path/to/cleanup_script.php"

Choose the option that helps you keep track of your cron jobs the easiest.

1
  • Adding the cronjob under the apache user worked. Which makes total sense.
    – joshholat
    Jul 9, 2012 at 17:01
0

You can either run cronjob from the Apache web server (so in Cron you put only HTTP call), as well you can make sure that all your permissions on the files and folders are 777 when you are creating them. When making a folder, you can specify mode, and when you creating the file, you can make the same. You can also use setacl on that folder, so both users have permission, and it's propagating down the folder, like this:

# mkdir /tmp/zip_files
# chown apache:apache /tmp/zip_files
# chmod og-rwx /tmp/zip_files
# setfacl -m u:test:rwx zip_files/    # allow test user to enter the folder
# setfacl -m d:u:test:rwx zip_files/  # assure test permissions to created files and folders
# setfacl -m u:test:rwx zip_files/
# getfacl /tmp/zip_files

Where "test" is your user you run the cron from.

ps. Forget sudo, you dont need to access root to do it.

1
  • I do know the random_hash_folder folders are being created with mkdir($dir, 0777). However, when creating the file I simply use ftp_get() which has no way of specifying permissions and using chmod() right after it in the script doesn't appear to work either. With regards to setfacl, my server says "Operation not supported". It's RHEL.
    – joshholat
    Jul 9, 2012 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .