I've been encountering an issue on a client site for the past couple of weeks where they can't upload files to a directory outside of the web root.

After looking in the error logs, it looks like PHP is spitting out errors saying the upload directory is not writable. This directory happens to be outside of the web root but there are no open_basedir restrictions on the server.

I have a test script that executes the following code:

$path = '/var/www/vhosts/testdir';
$writable = is_writable($path) ? 'is writable' : 'is not writable';

echo "$path $writable";

When I run the script from the command line with php test.php the directory is writable. However, when I access the page from the browser, it is not writable.

Both the web root directory and testdir belong to the same user and group and have 755 permissions set. I've tried setting the owner of both dirs to apache to no avail.

When I set the permissions for the upload directory to 777 it works, but obviously I don't want all my files to be readable and executable to everyone.

Distro is CentOS 6.7.

Am I missing something obvious here?

| improve this question | | | | |
  • What particular distro is this ? – user9517 Sep 2 '16 at 14:00
  • @Iain CentOS 6.7. Sorry for not making that clear, I'll edit my original post. – user373688 Sep 2 '16 at 14:01

Your problem is almost certainly SELinux. Files & directories outside the 'web root' will be unlikely to have the correct SELinux context e.g. httpd_sys_content_t.

You will have to change the SELinux context on the files/directories that you want to be able to write to.

| improve this answer | | | | |
  • Hi Iain, thanks for the reply. Do you have any guides that can show me how to do that? – user373688 Sep 2 '16 at 14:05
  • There is a site search facility in the top right of the page. There you will find there are lots of guides already available to you. – user9517 Sep 2 '16 at 14:07
  • The context for writable directories is httpd_sys_rw_content_t. The context httpd_sys_content_t allows only reading. – Michael Hampton Sep 2 '16 at 14:15
  • @MichaelHampton Isn't that for C7 and onwards ? Isn't the purpose of the http_unified boolean to make C7 work like C6 ? – user9517 Sep 2 '16 at 14:16
  • It's been that way since at least 6, maybe even 5. – Michael Hampton Sep 2 '16 at 14:16

The user or group running the httpd must have write access. PHP inherits this from httpd.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.