I have a bit of an odd set up, I think. I have groups for each domain my server hosts, and I add the user http to each domain group along with the users that should have access to the groups' domains. In my php script running from a directory 'public_html', I try creating a file:

$output = "";
print exec('touch test 2>&1', $output);

But I get

touch: cannot touch `test': Permission denied

and the file is not created. But here, clearly stated, the group has all permissions on the directory:

drwxrwxr-x 5 dwieeb example.com 1024 Feb  4 05:19 public_html

And here are the permissions on the php file in public_html that is trying to use the exec function:

-rw-rw-r-- 1 dwieeb example.com   59 Feb  4 05:19 test.php

How is this possible if http is part of the example.com group (as seen from a cat on /etc/group) and the directory has full permissions for the group? ...


I'm stumped.

EDIT (since apparently I'm not cool enough to answer my own questions yet):

Ah, I found the problem. Yes, I restarted Nginx, but the php-fpm daemon must be restarted as well when http is added to the group for my domain.

On Arch Linux:

rc.d restart php-fpm

A number of possibilities, in rough order of probability:

  • You might not have restarted the web server, so it hasn't picked up the group change;
  • You've got too many groups on the web server user (there is a static limit to the number of groups that a user can be a member of)
  • There could be ACLs or selinux limitations on the operation.

For these and so many other reasons, don't have your webserver run dynamic code. At the very least, use suPHP (or suexec, in the general case) to run your dynamic code as the relevant user. Running a real appserver behind the scenes is even better for performance.

  • AFAIK suexec doesn't play well with nginx; php-fpm does though, and also supports spawning multiple PHP processes with different user/group ID settings – Shish Feb 5 '12 at 5:23
  • I've restarted the web server multiple times. The web server user is currently only a member of http and example.com, (I'm setting up the server still). I don't know what ACLs are and I don't have selinux installed. It's pretty much vanilla Arch Linux + Nginx. I don't have my http user run console commands, I need it to work for file_put_contents(), which gives the same permission error messages. I figured I'd try it with a simple command through exec() to simplify the problem. – dwieeb Feb 5 '12 at 5:28
  • @Shish: Of course suexec won't "play well" with nginx, since it's an Apache-only feature that isn't necessary with nginx because nginx never runs content as part of the webserver. If the OP isn't going to put diagnostically useful information in the body of the question, nor provide an appropriate title, they're not going to get the most useful answers. – womble Feb 5 '12 at 8:14
  • On Linux, there is no static limit to the number of secondary groups a user can be a member of. There is a limit on FreeBSD and some other BSD nixen, but Linux is not one of them. – swelljoe Aug 7 '14 at 2:34

Restart the php-daemon:

rc.d restart php-fpm

(just so you can close this case)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.