0

My PHP script needs access to some files that are located in a completely different directory.

I have set the ACL for the www-data user to have read permission, but the PHP file_get_contets() function returns an error saying "Permission denied".

It only works if I set the www-data user or group for that directory, which I don't want to do, unless the ACLs don't effect programs running under set users and setting the ownership is the only way to do this.

ACL list:

# owner: user1
# group: group1
# flags: -s-
user::rwx
group::rwx
other::---
default:user::rwx
default:user:www-data:rwx
default:user:user1:rwx
default:user:user2:rwx
default:group::rwx
default:mask::rwx
default:other::---

Thanks in advance

  • Could you post the full ACLs (getfacl output) of the file in question and its parent directory? – user1686 May 29 '19 at 15:36
  • Added to the question. I've only changed the usernames and the group name for privacy reasons. And currently set rwx also does not work – fingust May 29 '19 at 15:42
  • Looks like you haven't added the ACL of the file itself, but I can already see one problem... – user1686 May 29 '19 at 15:43
0

Your output shows that you have set the "default" (inheritable) ACL for the directory, but not the "normal" (effective) ACL. In other words, the entries prefixed with default: exist only for copying to newly created files, but they do not immediately apply to this directory itself.

So the only effective permissions are these, and the only ACE matching users "www-data" and "user2" is the generic other::--- entry which grants no permission at all:

# owner: user1
# group: group1
# flags: -s-
user::rwx
group::rwx
other::---

Because "www-data" doesn't match any ACE that would grant +x (traverse) permission on the directory, it is not allowed to access any files inside, no matter what their own permissions might say.

To fix this, set the ACLs again, this time without adding the 'default' flag:

setfacl -m "u:www-data:rwx" the_directory
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.