1

I need to set the default ACLs on new files created by httpd via the apache service user in such a way that the file is created with the GUID set to the dev users account (which well call devs), and specific permissions.

It looks like I've got the SGID working just fine, as any files created by PHP web pages have the apache owner and devs group. But instead of having the ACLs of rwxrwx--- they have rw-rw----.

[root@webserver ~]# cd /var/www/html
[root@webserver html]# setfacl -Rb .                  
[root@webserver html]# chmod -R g+s .                
[root@webserver html]# setfacl -Rdnm u:apache:rwx,g:devs:rwx .
[root@webserver html]# getfacl .
# file: .
# owner: apache
# group: devs
# flags: -s-
user::rwx
group::rwx
other::---
default:user::rwx
default:user:apache:rwx
default:group::rwx
default:group:devs:rwx
default:mask::rwx
default:other::---

[root@webserver html]# getfacl data.txt
# file: data.txt
# owner: apache
# group: devs
user::rw-
user:apache:rwx     #effective:rw-
group::rwx      #effective:rw-
group:devs:rwx    #effective:rw-
mask::rw-
other::---

The data.txt file was created via a PHP script executed by httpd/apache. The ownership is setup properly (apache/devs), but it wasn't created with the executable permissions for either the user or group.

Thes server is running CentOS release 6.9 (Final)

Any ideas?

Thanks!

1

Linux file permissions are not affected by the setgid bit on the directory. Set Group ID causes the file to be created with the group ID of the directory, instead of the group ID of the creator.

The permissions on newly created files are specified by the creator of the file and affected by the file creation mask (umask) in the open or other system calls. To affect the file permission in PHP you would use fopen or chmod, etc.

This can be done without using ACLs. These commands accomplish the same thing:

chmod g+s .
chgrp devs .

It seems unusual and insecure for PHP to be creating executable files from httpd. I hope you know what you're doing.

  • Yeah, I see what you mean. These are mostly log files or debugging information that needs to be created by apache and accessible by devs. So theres no reason for executable permissions. I suppose I was more trying to figure out why execute wasn't added when I could get the files to be created fine with either rw-rw---- or r--r-----, but never rwxrwx---. Didn't really plan on leaving it there, especially in production. Thanks! – Justin Nov 1 '17 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.