Problem with permissions

patrik

patrik

Verified User
Joined
Sep 6, 2006
Messages
128
Users with web applications like Joomla with most likely encounter problems with permissions if they would like to remove or edit files within a component/module they have installed because it's owned by the webserver user.
Some use suPHP to solve this but we've had very bad experience with this tool and don't want to use it.

What solutions are there? We could set permissions to something like 775 or 774 (or even 770) and then set group to the webserver user but this require help from system administrators as the users themselves can't change group.

I have been looking at file system ACLs which seems like a very good solution. It's possible to set default permissions for a directory to be writeable by both webserver and the user. If a new file/directory is created within the directory which has default ACLs set the new file/dir should inherit the permissions. That's how it is meant to work but I can't get it to work.
Is there someone here who have any experience with ACLs (getfacl, setfacl)? Or is there any other solution to this problem?
 
If you can change the directory permissions to 2775 (suGID) then when you create a new file in this dir by means of php, then the file is owned by apache user and site user group.

Hope this help.
 
I'm not sure what you mean, what is suGID and how does it work? Googling on suGID and I get lots of hits about security.

How are you other guys dealing with this problem? For example, customers who want to make changes to their newly installed Joomla customers will run into problems because they cannot modify files nor add new ones in the directory.

I tried to set umask for httpd to 002 instead so new files was writeable by the group (which always seems to be the user).
I added umask 2 to the apachectl script and it worked fine until now when I noticed it didn't work anymore. New files aren't writeable by the group.
How can I set umask to 2 for httpd? Is this a safe solution?
 
When a directory is created it gets the correct group although the permissions for that group is r-x så the user still can't modify it.
 
You must log in or register to reply here.
Back
Top