Apache CGI Script Can Cannot Overwrite a File in a Directory it has full permissions to

Question

Having a weird problem on a Solaris 10 box. I have a cgi script (perl) which needs to overwrite a file. We do not have suexec running on Apache so the destination directory has full (777) access so that Apache can write to it.

The problem is that the CGI script is able to write a new file to the directory but not overwrite an existing file.

**Directory permissions for file destination:** 

drwxrwxrwx 146 myuser white      32768 Jun  2 20:46 dest-dir

**File Permissions of file that needs to be over written:** 

-rw-r--r--   1 myuser white      0 Jun  2 20:50 cgitestfile

Anyone know a simple solution for resolving this ??

Seems like apache can only overwrite a file if it owns it.

Answer 1

-rw-r--r-- 1 myuser white 0 Jun 2 20:50 cgitestfile

You only have write permissions on the file for owner (myuser) Is apache running as user myuser? or as apache or www.data or something like that? Perhaps you need to add write access for other?

Answer 2

On Solaris 10 the default is for apache to run as User nobody, Group nobody (check /etc/apache/httpd.conf User and Group directives). Given your example apache won't be able to write to the cgitestfile as it has no write access to it.

Change the owner:group of dest-dir and the files you want apache to overwrite to nobody

Answer 3

I ran into this due to the "SELinux" configuration. If SELinux is running, you need to explictly enable the ability for Apache to write to files. To use this, you also need to set additional permissions on those directories and files for which you are granting write access.

To determine if SELinux is enabled, execute:

sestatus

To turn on the SE booleans which enabled cgi to write to files:

sudo setsebool -P allow_httpd_anon_write 1
sudo setsebool -P allow_httpd_sys_script_anon_write 1

Then, finally to set the file/directory "SELinux security context type" to a "system" read/write file/directory (you could also make it a "public" type - Google "chcon" for info), execute this:

sudo chcon -R -t httpd_sys_rw_content_t /some/write/path

(Change /some/write/path to your path.)