Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When running a script I get the following error: 'The folder "x" is not writable.' Folder's permissions are 755. Folder ownership is user:user. PHP runs as apache.

When changing group ownership of folder to apache it works, but it's not very practical.

Ideal would be if any admin could upload a script which can be executed without problems.

What is the commonly accepted/best solution for it?

P.S. I run standard clean CentOS 6.x

share|improve this question
    
From other answers I've found that there can be also www-data (how does it work/it's relationship with apache and users?) owner, and other option is a module that runs each child process as a different user called mpm-itk. This allows to run each vhost under a separate userid. Can anyone share pros and cons of each set up, and suggest the most commonly used and secure approach? –  JamesS. Sep 18 '13 at 3:49
    
change the ownership for directory to www-data:www-data as www-data is apache user in CentOS. –  Abhishek Anand Amralkar Sep 18 '13 at 3:59
add comment

1 Answer

up vote 0 down vote accepted

775 breaks down like this:

first 7  - user read/write/execute
second 7 - group read/write/execute
last 5   - others read/execute

In order for the apache user to be able to write to the folder, it will need write permission, so either it will need to have group perms, ownership of the folder or have full read/write/execute to everyone on the server.

share|improve this answer
    
I know the concept, but how do I implement it? I don't want add every user to apache group, and I don't want make every folder owned by Apache. Does it mean I have to run php not as Apache? –  JamesS. Sep 18 '13 at 3:26
    
You only need to make that folder owner, not the entire tree (which is highly discouraged). Plan B is to set the permissions as 777, which might not be a good idea if you have users on that server that you don't want access. Plan C is to use ACLs instead of Linux permissions, if CentOS 6.x supports them. –  Aaron Mason Sep 18 '13 at 4:13
    
Thanks, I'll research on ACL. Is there a way to set group ownership for all folders uploaded by admin group users to apache? –  JamesS. Sep 18 '13 at 5:00
    
Try using a sticky bit in chmod (chmod g+s foldername). –  Aaron Mason Sep 19 '13 at 1:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.