0

I want to make a folder always writeable by PHP.

I changed the folder permission temprorarly to 777, but the content of the folder is uploaded by a ftp user, so every time I rerun the script I get this:

Warning: file_get_contents(/var/www/html/.../file.txt): failed to open stream: Permission denied in /var/www/html/.../autoimport.php on line 25

The same is happening to me in this script, where I show the content of error.log. I change it to 777 but when it is re-generated I lost access again.

Warning: fopen(/var/log/apache2/error.log): failed to open stream: Permission denied in /var/www/html/admin/errorlog.php on line 48
Could not get lines from file - /var/log/apache2/error.log
2
  • What is the permission of /var/log/apache2/error.log?
    – Ramhound
    Nov 20, 2014 at 17:56
  • -rw-r----- 1 root adm 75430 Nov 20 12:50 error.log Nov 20, 2014 at 17:57

1 Answer 1

1

The way I typically do this in my server setups is to create a group for the website, then use a combination of setgid and umask to make sure that files remain writable by the applications I want. Step by step guide below:

1/ Create a new group for your website:

$ sudo groupadd web-grp

2/ Add the user the webserver runs as to the group:

$ sudo gpasswd -a www-data web-grp

3/ chown the diretories and files that you want the server to have access to:

$ sudo chown -R :web-grp /path/to/website

4/ Set the gid bit and other permissions on those directories:

$ sudo chmod -R ug+rw /path/to/website
$ find /path/to/website -type d -exec chmod g+xs {} \;

5/ Set your ftp program's umask to 002. This will depend on your ftp client and server, search around to figure out how to do this for your particular setup.

6/ Restart your web server to pick up the new group permission:

$ sudo service apache2 restart

The interesting thing here is the setgid bit on those directories will cause new files created in the directories to have the same group by default. This means you don’t need 777 permissions—which means you have more security as well as a system that should continue to work.

The umask part is also important. New files will have the permission bits in the umask stripped, so if your umask is 022, the new files will not be group writable, and things won't work very well.

I've been using this setup very successfully for a number of years now.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .