How to make Apache obey to default ACL on Fedora 19?

Question

I have set default ACL to allow me doing anything on newly written files. But Apache seems to ignore that, and I don't have access to newly created files. How to fix that?

Answer 1

If you are meaning the permissions that are controlled by chmod/grp/own, then try using sudo with su ang sg to become that user

sudo -s

[Password]

sg apache

su apache

Once you have done that, try to use cat to read those files, if that works you are done!

to fix this scenario

chgrp apache -R <FOLDER>

chmod g+rX -R <FOLDER>

Otherwise, if you are talking about the extfs acls, which can be seen by files having a + in their ls record

[mock@vbox ~/footest]$ ls -all

-rw-rwxr--+ 1 hauna hauna 0 Jul 29 15:14 fileacl

-rw-rw-r--. 1 hauna hauna 0 Jul 29 15:13 filenoacl

this one can be dealt with like the following

setfacl -m g:apache:rx <FOLDER>

If you are taliking about selinux, you will need to change the default context of location where the files are created, this MUST be done as root!

semanage fcontext -a -t httpd_sys_content_t '/srv/httproot(/.*)'

that will affect future files, to affect the current ones, use this

restorecon -R /srv/httproot

I Hope that clears it up,

I would apreciate a post of the error log for apache, and an ls -all of the directory in question, as well as any audit logs (in /var/log/audit/audit.log) that appear about the same time and were denied

Answer 2

I am leaving the other answer as it is valid for another question!

First you need to change the umask that Apache is running under

sudo echo "umask 117" > /etc/sysconfig/httpd

this will cause the files that apache creates to be chmod'd 660 (noexec is a good idea)

and then add yourself to the apache group

sudo usermod -aG apache MYSELF