PHP User in NGINX not Accessing File, Permission with Group

Question

I know that nginx sets the user for php as www-data. Therefore the user www-data needs access to the entire structure as described in this blog post.

To express my issues I will have to define some parameters:

1. Lets define the php user as 'www'.
2. Lets define a human user as 'mods'.
3. Lets define a group called 'webaccess'.
4. Both 1 and 2 are members of 3.

The idea here is that I want html directory and all sub file set to mods:webaccess 750 so that mods can upload and modify php files, and that, obviously, www can access and handle php requests.

The problem is that, with this setting I keep getting the "No input file specified." error. Now, since the www user is a member of webaccess, shouldn't they should be able to read the php files with the permissions of rx set for the group?

To verify that it is in fact a permissions issue and not a path issue, I added a php file in the web root containing <?php echo exec('whoami'); ?>, with the permissions set to 750, I get the "No input file specified." error. So I change the permissions to 755 and then I get back the user 'www'.

Answer 1

In a non-interactive shell, it's possible that your 'www' user is only getting their primary group (as defined in /etc/passwd) and not any additional groups (as defined in /etc/group).

You can probably test if this is the case using:

<?php echo exec('id'); ?>

If webaccess isn't listed in the groups, that's probably why it can only read the files when Other has access.

EDIT:

This problem looks similar to one dwieeb had (https://serverfault.com/questions/356959/user-http-does-not-have-write-permissions-directory)

Ah, I found the problem. Yes, I restarted Nginx, but the php-fpm daemon must be restarted as well when http is added to the group for my domain.

If you haven't already done so since adding www to webaccess, try restarting Nginx and php-fpm.