Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a symfony2 application on my ubuntu. Symfony has a plenty of useful console commands (like php app/console cache:clear or php app/console assets:install web).

The problem is If I run them as root user the newly generated files will have root:root user/group, and if I acces my website I get errors (becouse apache cannot read/modify these files -> they should have www-data:www-data).

Running chown www-data:www-data solves the problem, but running it every time I clear my cache is not a solution.

How can I configure PHP CLI to always run as www-data user/group?

or

How can I run a command as a diffrent user (being root, run it as www-data)?

share|improve this question

4 Answers 4

up vote 4 down vote accepted

Run a command as another user once:

sudo -u www-data php script.php

This should work if you are root.

As for always running php as www-data, there are several possiblities. You could create a simple wrapper shellscript. If /usr/bin/php is only a soft-link to /usr/bin/php5 or similar, that makes it simpler. Just replace the soft-link (NOT the file php5) with a script like this:

#!/bin/sh

sudo -u www-data php5 $*

return $?

That's not tested though. Also be aware that this will ALWAYS try to run php5 as user www-data, even if the user may not be root and may not have permission to do so. And it may also not be what you really want. Some installed services may run into problems when trying to execute php.

A (possibly better) solution to only apply that to root may be to leave the soft-link /usr/bin/php alone and place the script in /root/bin instead. Then add that folder to PATH via .bashrc, .profile or similar. If you have /etc/skel/.profile, that may point out how that is done:

# set PATH so it includes user's private bin if it exists
if [ -d "$HOME/bin" ] ; then
    PATH="$HOME/bin:$PATH"
fi

Once this is in your .bashrc, .profile or similar, every new shell you open will allow you to directly execute any executables (+x) in $HOME/bin (/root/bin for root).

Hint: You may want to name the wrapper script something like phpwww so you explicitly specify php script.php or phpwww script.php to decide if you want regular or sudo'ed php.

Another solution is a simple alias. Place this in your .bashrc, .profile or similar:

alias phpwww='sudo -u www-data php'
share|improve this answer
    
Funny, half a hear has passed and I stumbled upon my own question again =) Seems like I forgot to accept your answer last time - I just fixed that, thank you! –  loostro Jul 4 '13 at 2:48

Answered by mwargh on ##linux (IRC Freenode.net)


To run a commands as a diffrent user -> switch to that user useing:

su www-data

I'd still be interested (if its possible) in configuring PHP so that running:

root@mycomp php (php script creating a file)

as root user

will result in creating a file with www-data:www-data user/group

(this way i would not have to switch from root to www-data to run my commands)

share|improve this answer

I would try making /usr/bin/php owned by www-data and set the suid permission, which forces the command to be executed by the file owner. You'd do this with:

chmod u+s /usr/bin/php

of you like the octal notation:

chmod 4755 /usr/bin/php

Though I must say it should make one uneasy whenever you are making www-data the owner of anything, as the point of the www-data account is to own as little as possible.

share|improve this answer
    
Which is why I'll go with riha's answer –  loostro Jul 4 '13 at 2:49

if you got the php-fpm (FastCGI Process Manager)
you can set it up in the config file located at (atleast for centos): /etc/php-fpm.d/www.conf
at line 39 you can set the user and 49 you set the group

share|improve this answer
    
That doesn't apply to php-cli, does it? –  riha Nov 30 '12 at 12:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.