Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm making a website builder, and I have the file render.php, which needs to write to users’ directories. I don't want to give each of the users’ directories 0777, but I still need to be able to write to them. Is there a way to do this?

So far I've got:

  • render (dir) ... 0777
  • render.php ... 777 WritesTo->
  • users (dir) ....... 0777
  • index.php ..... 777

I want to change this to allow render.php access to change the users’ files, but not allow the files themselves to execute code.

share|improve this question
    
It's not immediately clear from your question if you need to create files, append to existing files or edit existing files. All of these operations require different permissions. –  Dennis Mar 4 '13 at 21:36
    
@Dennis On Ubuntu, I believe traditional permissions would be the same for append and edit (though ACLs might change things). –  cpast Mar 4 '13 at 21:46
    
@Riiich: Look into ACLs. They can provide custom permissions for multiple users, not just one owner. –  cpast Mar 4 '13 at 21:48
    
@cpast: Appending does not require read permissions on the file. –  Dennis Mar 4 '13 at 21:53
    
@Dennis Ah, that makes sense. –  cpast Mar 4 '13 at 22:19

3 Answers 3

If i understand you right i think this procedure should give you what you want.

  1. Create a group renderusers for the user directory: groupadd renderusers
  2. Change the group of the user directory to renderusers: chgrp renderusers user
  3. Add the user of your apache process (apache or www-data) to this group: usermod -G rendergroup -a apache
  4. Change the permissions of the user directory to include set group ID so that the group renderusers can write and change files and every newly created file will be owned by the renderusersgroup in this directory: chmod -R 2770 user
  5. Restart apache so that it recognizes his new supplementary group

I assume that you are running php as a DSO module and not via cgi.

share|improve this answer
    
Hi there! Just trying this, thank you for the clear instructions. On #2 I get chgrp: cannot access 'user': No such file or directory. As for your question on DSO or CGI, I honestly have no idea! I installed lampp and I'm using that if it helps! –  Riiich Mar 5 '13 at 16:39
    
Like an idiot I thought user was the user, I mistyped the dir it's actually "users".. I tried all of the instructions even changed the group of the render dir to renderusers but still nothing I'm afraid! –  Riiich Mar 5 '13 at 17:08
    
Still no access to the file :/ I've been playing around a bit but still nothing.. –  Riiich Mar 5 '13 at 17:52
    
Could you please show the current permissions of the users directory? ls -la users. Also getent group | grep -i apache if your apache user is apache and not www-data. –  morlix Mar 5 '13 at 18:11
    
getent group | grep -i www-data = www-data:x:33: renderusers:x:1002:richard,www-data ls -la users = drwxrwxr-x 5 richard 2770 4096 Mar 4 18:17 . drwxrwxr-x 28 richard richard 4096 Mar 6 13:30 .. drwxrwxr-x 3 richard 2770 4096 Mar 1 00:08 1 drwxrwxr-x 3 richard 2770 4096 Mar 4 18:17 3 drwxr-xr-x 3 richard 2770 4096 Feb 25 00:54 riiich The username I've logged onto my server is richard –  Riiich Mar 6 '13 at 14:31

I’m not sufficiently familiar with Apache to be able to walk you through the procedure configuring the website, but I can suggest an answer at the Unix permissions level:

  • Define a new group (e.g., riiich_app),
  • do chgrp riiich_app and chmod 775 on each of the users’ directories (and tell them not to change that), and then
  • configure your web server to run your render.php under the riiich_app group.
share|improve this answer
    
Thank you for the clear instructions, I'm trying it as we speak! What benefits are there in putting the directories into a group? Wouldn't the users still be able to run malicious code? And the users can't change anything like that, at the moment it's just a simple HTML -> file builder, I'm just worried if they should happen to get in some PHP script and delete everything –  Riiich Mar 4 '13 at 22:26
    
If a directory (or a file, for that matter) is owned by fred with a group of riiich_app, and has a mode of 775 or 664, then Fred will have write access to it, as will anybody in the riiich_app group (but nobody else). “anybody in the riiich_app group” should be interpreted as “any process running under the riiich_app group ID”. // I believe that I don’t entirely understand your question. What do you mean by “the users can’t change anything like that” –– are you saying that they cannot login to a shell (e.g., by telnet or ssh)? –  Scott Mar 4 '13 at 22:43
    
Not at this current point in time no, I basically only have a WYSIWYG editor with add, edit and remove page functions. I just don't want them to rmdir "../*" (I know that's not real code, I'm just illustrating. –  Riiich Mar 4 '13 at 22:53

You can give your webserver's username the 0777 permissions. In the case of Apache2, that is www-data. Not exactly sure how to do that with chmod, but you can chown www-data 777.

share|improve this answer
    
I don't think giving everything 777 is exactly "safe" –  Riiich Mar 4 '13 at 20:49
2  
Give a user[name] the 0777 permissions? chown www-data 777? That doesn’t make sense. –1 –  Scott Mar 4 '13 at 21:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.