I have set default ACL to allow me doing anything on newly written files. But Apache seems to ignore that, and I don't have access to newly created files. How to fix that?
2 Answers
If you are meaning the permissions that are controlled by chmod/grp/own, then try using sudo with su ang sg to become that user
sudo -s
[Password]
sg apache
su apache
Once you have done that, try to use cat to read those files, if that works you are done!
to fix this scenario
chgrp apache -R
<FOLDER>
chmod g+rX -R
<FOLDER>
Otherwise, if you are talking about the extfs acls, which can be seen by files having a + in their ls record
[mock@vbox ~/footest]$ ls -all
-rw-rwxr--+ 1 hauna hauna 0 Jul 29 15:14 fileacl
-rw-rw-r--. 1 hauna hauna 0 Jul 29 15:13 filenoacl
this one can be dealt with like the following
setfacl -m g:apache:rx
<FOLDER>
If you are taliking about selinux, you will need to change the default context of location where the files are created, this MUST be done as root!
semanage fcontext -a -t httpd_sys_content_t '/srv/httproot(/.*)'
that will affect future files, to affect the current ones, use this
restorecon -R /srv/httproot
I Hope that clears it up,
I would apreciate a post of the error log for apache, and an ls -all of the directory in question, as well as any audit logs (in /var/log/audit/audit.log) that appear about the same time and were denied
-
I'm talking about Apache restricting me file access, not vice versa. Jul 29, 2013 at 20:15
-
Ah, So, you need a <location FOLDER> block in then apache configs? so are you getting a 503 error? or do I not have a clear understanding of the problem? ...Seems these boxes do not do newlines...– LaikuloJul 29, 2013 at 20:22
-
No. Apache creates files as Apache, with 700 chmod, so I can't access them. How to solve this? Jul 30, 2013 at 19:12
I am leaving the other answer as it is valid for another question!
First you need to change the umask that Apache is running under
sudo echo "umask 117" > /etc/sysconfig/httpd
this will cause the files that apache creates to be chmod'd 660 (noexec is a good idea)
and then add yourself to the apache group
sudo usermod -aG apache MYSELF
-
You could also modify the code that creates the files to chmod them itself (as apache owns the files, it can chmod them) See PHP's chmod($filename,$mode) function– LaikuloAug 7, 2013 at 16:34