I need files created by apache2 to have umask 002, i.e. group rw, by default.

I've tried putting umask 002 in /etc/apache2/envvars and although this script does get executed as part of apache start up (apache2ctl graceful) the umask has no effect. Presumably somewhere further in the start up process (e.g. when the user is downgraded from root to www-data) there's somewhere better to put this.

I've read posts about Fedora and one suggesting putting umask in /etc/init.d/apache2 but neither of these apply/work in Debian (Squeeze).

Can you help?

  • 1
    You should try to restart Apache with "/etc/init.d/apache2 restart" or "service apache2 restart" Apr 28, 2012 at 17:55
  • yep, neither worked. Apr 28, 2012 at 22:27
  • How do you create new files (WebDAV, PHP)? Apr 29, 2012 at 5:27
  • In my test, I'm using file_put_contents(). but the code I'm trying to 'fix' with this is Drupal's Less module (which creates cached versions of processed Less CSS files). My specific problem is that I cannot run drush cc all as my user because it errors out on all these www-data created cache files. Apr 30, 2012 at 9:15

3 Answers 3


To be sure that the umask setting takes effect please use a simple test and do not use any other web application for this. It might be the case that these application change the rights independently from the umask setting of Apache.

Simple test PHP script:

if ($fp = fopen(time() . '.txt', 'w')) {
  fwrite($fp, 'This is a simple test.');
  echo "done";
} else {
  echo "error - cannot create file";

Take care that the user www-data has write access to the folder where you have installed this simple test file.

To have the new umask running, check if the file /etc/apache2/envvars will be used within your Apache start file /etc/init.d/apache2 :

PIDFILE=$(. /etc/apache2/envvars && echo $APACHE_PID_FILE)

Set your umask in /etc/apache2/envvars :

# umask 002 to create files with 0664 and folders with 0775
umask 002

Restart your Apache :

service apache2 restart

Check the difference :

#> ls -l *.txt
-rw-rw-r-- 1 www-data www-data  14 2012-05-01 15:56 1335880583.txt
-rw-r--r-- 1 www-data www-data  14 2012-05-01 15:55 1335880540.txt
  • Thank you! Even if it made me feel like an idiot to read it (I had the wrong octal for group rw) *blush* May 1, 2012 at 15:26
  • Your little PHP snippet saved my sanity, PDO Sqlite3 Wordpress plugin will always set group to read only for it's database file. Feb 17, 2016 at 6:12

If you run multiple sites you can set default group permission using Access Control Lists (ACL) per directory like so:

Set setid flag to force all new files to inherit group from directory:

# chmod g+s wordpress

Make new files have rw for the group permissions, ex. so that www-data can write to files SFTPed by the upload user:

# setfacl --default --modify group::rwx wordpress 

Confirm the ACL is like so:

# getfacl wordpress
# file: wordpress
# owner: carissacosgrove
# group: www-data
# flags: -s-

Create a file to confirm it worked:

# ll test
-rw-rw-r-- 1 root www-data 0 Feb 17 01:09 test
  • Won't this be problematic if the application is trying to write files with reduced permission on purpose?
    – berbt
    Feb 20, 2016 at 22:28
  • Not at all, the application will just write with reduced permissions which actually confused me for a bit initially - stackoverflow.com/questions/28454551/… Feb 20, 2016 at 23:07
  • 1
    I think this command setfacl --default --modify group:rwx wordpress is missing a colon. It should be setfacl --default --modify group::rwx wordpress
    – Marcos
    Sep 20, 2016 at 14:16

(For Debian Stretch that uses systemd - Thanks womble!)

Put UMask=0002 in the Apache2 systemd service unit file, reload the service unit, and then restart Apache2.

$ pwd

$ cat apache2.service
Description=The Apache HTTP Server
After=network.target remote-fs.target nss-lookup.target


$ sudo systemctl daemon-reload
$ sudo systemctl restart apache2
  • Debian Squeeze didn't use systemd.
    – womble
    Dec 16, 2019 at 23:58
  • Ah yes, at the end of the body of the original question they do say Debian Squeeze. As the question was from ~8 years ago as of today, and as I was trying to solve the problem posed in the title with the latest Debian as of late 2019, that is what I posted. I think most people searching for a solution today as opposed to eight years ago may benefit from my solution, so I'll just leave what I put in. Thanks for pointing that out. Dec 18, 2019 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .