Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

UPDATE2

If I do ls inside the mounted directory the php script works at least once. Strange, isn't.


I want to access a directory from my php script that is mounted from

  • datadev server (Linux datadev 2.6.22.18-0.2-default #1 SMP 2008-06-09 13:53:20 +0200 x86_64 x86_64 x86_64 GNU/Linux)

  • into wwwdev (Linux wwwdev 2.6.22.19-0.1-default #1 SMP 2008-10-14 22:17:43 +0200 x86_64 x86_64 x86_64 GNU/Linux)

via nfs

  • /etc/exports is like ( tried some things that didn't work for me)

    • /var/lib/firebird/data 10.0.0.20(rw,no_root_squash)
    • #/var/lib/firebird/data 10.0.0.20(rw,setuid,no_root_squash)
    • #/var/lib/firebird/data -mapall=wwwrun:wheel 10.0.0.20(rw)
    • #/var/lib/firebird/data 10.0.0.20(rw,all_squash,anonuid=30,anongid=100)
  • /etc/fstab is like

    • 10.0.0.21:/var/lib/firebird/data /var/lib/firebird/data nfs defaults 0 0

I can access the directory from the shell but php gives me an error Permission denied (errno 13) if I do chdir('/var/lib/firebird/data');

[root][wwwdev /var/lib/firebird/data] ls -la
total 44G
-rw-rw---- 1 firebird firebird   64M Jun 10 15:43 ?
-rw-rw---- 1 firebird firebird  307M Jun 15 10:27 ?OQben.gdb
drwxr-xr-x 2 firebird firebird   16K Jul 21 16:55 ./
drwxr-xr-x 3 firebird wheel     4.0K Jul 21 11:36 ../

-

[root][datadev /var/lib/firebird/data] ls -la
total 44G  
-rw-rw---- 1 firebird firebird   64M Jun 10 15:43 ?
-rw-rw---- 1 firebird firebird  307M Jun 15 10:27 ?OQben.gdb
drwxr-xr-x 2 firebird firebird   16K Jul 21 16:55 ./
drwxr-x--- 4 firebird firebird  4.0K May  7 12:19 ../

my php script can edit config.ini file

root][wwwdev /var/lib/edumate/imacs/radek/3.0] ls -la
total 128K
drwxr-xr-x 19 wwwrun wheel 4.0K Jul 21 16:27 ./
drwxr-xr-x  6 wwwrun wheel 4.0K Jul 19 14:28 ../
-rw-r--r--  1 wwwrun wheel 1.8K Jul 21 15:08 config.ini

UPDATE

I want something that is already working for me. I have mounted directory from my mac to the same server wwwdev. wwwdev is a nfs client in both cases. /etc/exports on mac has this line in /Users/radek/Sites -mapall=root:wheel -network 10.0.0.0 -mask 255.255.255.0

share|improve this question

4 Answers 4

up vote 1 down vote accepted

As others have suggested, you should modify the permissions of the exported directories to allow the web user (wwwrun) the minimum amount of access to them. What exactly you change them to depends on your system and security needs.

If, for some reason, you cannot modify the permissions of the directory, you may be able to add the web user (wwwrun) to the (firebird) group on the local machine. I'm not sure off the top of my head how NFS will handle it if the GIDs differ on the two boxes, but we can sort through that if that's the case.

That is probably not the safest way to do it, but I'm not sure about your constraints for this.

Just curious... what is the reason the web server will need direct access to this location? If this is the location of you database files, it can open up a new avenue of data corruption if you are not extremely careful. Wouldn't it be better to use a Firebird/InterBase connector?

share|improve this answer
    
the reason why I want to have the database directory to be mounted is that I am writing php script to change/switch settings for different builds so I can do my testing easily and faster. I can add additional and very useful features to this php script if the script can access the directory. Security is 'not' an issue here as everything is happening 'locally' nothing goes over the Internet. I cannot understand how changing permissions could help is current settings WORKS but only sometimes :-) I mean :-( If I do 'ls /mounteddir' and then run php everything works nicely. Usually just once... –  Radek Jul 29 '10 at 2:31
    
what do you mean by 'local machine'? I am talking here about two servers. Did you mean the nfs client? –  Radek Jul 29 '10 at 2:33
    
Yes, by local machine, I mean the NFS client. What actions are you doing that "works" and what are the permissions of the associated files? Are you talking about the chdir, or something else? Looking at the permissions of the files you listed, it has RW for the firebird user and members of the firebird group, nobody else. Unless wwwrun is a member of that group or the permissions are updated, that user should not have any access to those files. the ls /var/lib/firebird/data works because "Others" has read and execute permissions to that directory, so they can list the contents. –  pferate Jul 29 '10 at 16:30
    
`ls /var/lib/firebird/data' trick works but only for some time and I have to do it manually. Of course I want to list the directory from my php script and at any time. –  Radek Jul 29 '10 at 23:22
    
if I write something from php script the owner is root and grop is www. I cannot write in /var/lib/firebird/data though. I can in a mounted dir that comes from my mac. –  Radek Jul 29 '10 at 23:24

To change the permissions for the mounted drive, ensure that the Apache user is permited access in the fstab file.

The Apache user account is specified in the Apache configuration file (httpd.conf), and may be something like "www-data" (depending on the configuration).

See this article: How to edit and understand /etc/fstab

EDIT1

If there is no problem with fstab, then the next stop is with SELinux.
From nfs Selinux Policy documentation :

SELinux policy is customizable based on least access required. So by default SElinux policy does not allow nfs to share files.

If you want to share files read/write you must set the nfs_export_all_rw boolean.

setsebool -P nfs_export_all_rw 1

To be absolutely sure that SELinux is not interfering, see How to Disable SELinux.

EDIT2

The next and last step I can find is to check whether you have correctly exported the shares from the NFS server. Here are some references that may point the way:

NFS-mount “Permission denied” error
Sharing NFS Resources

share|improve this answer
    
@harrymc: I didn't find anything related to fstab in php.ini :-( –  Radek Jul 25 '10 at 23:05
    
@Radek: It's a Linux file that controls mounts. It's during the mount that the php account should be given the right to access it. php.ini doesn't refer to it (and doesn't need to). Please read the article for details. –  harrymc Jul 26 '10 at 5:51
    
the article doesn't add any more light to my question :-( See the UPDATE2. It works sometimes –  Radek Jul 26 '10 at 6:19
    
@Radek: I have added the next logical step in my answer. –  harrymc Jul 26 '10 at 7:56
    
@harrymc: it seems to me that we don't have SELinux on our server. I cannot run 'setsebool' nor find any selinux settings.... –  Radek Jul 27 '10 at 1:44

Normally, Apache is running is a different user (f.e. www). You're accessing the directories via root...and of course you're allowed to do so.

Change the permissions on the mounted folder to reflect that the Apache-User is allowed to enter them.

share|improve this answer
    
but how can I change the permissions on mounted folder without changing it on primary/shred folder? It is working for me from mac but datadev cannot recognise -mapall option in /etc/exports –  Radek Jul 21 '10 at 23:17

our sysadmin fixed the problem for me. He says that he

  • created new group xyz on both nfs server and client and then added firebird and wwwrun into this group
  • umount the dir and set up the user, group, permission exactly the same on both (server and client)
  • mounted it again and it works since ...
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.