Read-only files, prevent deletion

Question

Here's my situation. I'm running a WordPress website that uses w3 total cache. A large portion of this website is at first dynamic, and then static. So I'm caching these pages as static HTML in a folder, let's call it /home/test.com/wp-content/cache/page_enhanced/static/. So each file in that folder is an HTML representation of what someone would get if they visited test.com/static or test.com/static/foo or test.com/static/foo/bar. Any files in this folder won't need to be updated for 6 months or so, but there'll be 40K+ files in directories.

I ran a python script (Optimus Cache Prime) to visit all pages in a sitemap.xml to generate all files that would go in that folder. Apache then gets a requests for test.com/static/foo, skips all of the PHP and SQL processing and serves up an HTML file (so a request to http://test.com/static/foo serves up the file located at /home/test.com/wp-content/cache/page_enhanced/static/_index.html).

I want those files to exist in that current form until I go into the folder as sudo and delete those files manually.

Not all files in /home/test.com/wp-content/cache/page_enhanced/ should exist in that current form, just the /static/ directory and it's subdirectories.

So I went to /home/test.com/wp-content/cache/page_enhanced/static/ and ran find ./ -type f -exec chmod 444 {} \;. To my surprise, most of the files had been deleted today (it had to have been by the PHP script, I'm the only one with ssh access).

How can I prevent that from happening? Dedicated Ubuntu web server. Seems easy, but I'm a web dev, I only know enough to be dangerous.

Edit: I don't want to set permissions on the folder, because there'll be some things on the fly that need to be cached and then served up. So http://test.com/search/weird+search+term+foo+bar should be dynamically cached as _index.html once somebody searches that, so the next time someone searches it, it won't have to go through PHP and SQL processing.

So secondary problem, I need to say any files within my directory should automatically gain these permissions, but that's less of a concern for now.

Answer 1

If apache is running as the 'user' account which owns those files (perhaps 'apache'), then as the owner of the files it can change the permissions, which will allow it to delete them. Or, if apache is running as root, it can largely do as it pleases.

Some options that come to mind could be changing the ownership of the files to an account that apache isn't running as, not running apache as root (if it is), or setting some of the more esoteric permission values that exist in certain filesystems and operating systems. A couple examples include setting filesystem attributes ( man 'chattr' and check out the -i "immutable" option ), filesystem level access control lists ( man 'setfacl' ), or mandatory access control systems like selinux.

Answer 2

Just create them in a separate location then use a read only bind mount to it.

For example:

You want /home/test/x to be read only.

Create everything as /home/test/x.writable/*.

mount -o bind -o ro /home/test/x.writable /home/test/x

Another solution would be to enable ACLs on your partition and use them to block writing to those files.