I have searched the web for possible solutions but it seems to make me more and more stuck.
Once a file is created by PHP that file cannot be deleted, other files in the same directory can be deleted.
If a directory is created by PHP the whole directory cannot be used by FTP, I can see the files in that directory, but cannot delete, modify or upload to this directory.
I do see a lot of these questions here but mostly they involve permission problems, in this case all permissions, umask and attributes are the same as a file that can be deleted on through FTP.
I also thought it might be that the file is in use, however this is not the case, (lsof results empty, killing apache and nginx, which normally releases the file did not help either).
The server is running PLESK 11.0.9
FTP server is ProFTPD.
Is this some limitation that is caused by PHP, PLESK or is it in ProFTPD itself?
I hope you can help me with it, as I'm quite getting frustrated.
If you have any questions that might help in answering this question, feel free to ask :).
[ EDIT ]
Some more details why I think it is not a permission problem.
[root#srv domains]# lsattr
-------------e- ./test
-------------e- ./test2
[root#srv domains]# ls -als
total 32
4 drwxrwxrwx. 7 user0041 psacln 4096 Mar 22 06:41 .
4 drwxr-x---. 12 user0041 psaserv 4096 Mar 22 07:28 ..
4 drwxrwxrwx. 2 user0041 psacln 4096 Mar 22 06:30 test
4 drwxrwxrwx. 2 user0041 psacln 4096 Mar 22 06:34 test2
[root#srv domains]# lsof test
[root#srv domains]#
I cannot do anything with the directory test through ftp, but I can do anything with the directory test2
test has been created with mkdir command of php, while test2 has been created through ssh, and has been chowned to the right user.
Also I removed some unrelated entries from the outputs
More information about the user proftpd runs when logged in:
[root#srv domains]# ps aux | grep ftp
10000 8508 0.5 0.0 152192 3684 ? SNs 08:37 0:00 proftpd: user0041 - x: IDLE
[root#srv domains]# cat /etc/passwd | grep 10000
user0041:x:10000:505::/var/www/vhosts/domain.ltd:/bin/false
For privacy matters I have changed the domain name to domain.ltd.
Looks like your FTP user doesn't have permissions to delete anything created by the user that PHP is running as. You'll need to contact your hosting company regarding this.
most likely a user permission problem. but it could help if you posted some use case with more details describing what exactly are you doing (file names,process,...)
Related
I cannot manage to set the SGID bit from PHP.
I have this directory:
4 drwxrwsr-x 12 www-data mygroup 4096 Oct 7 16:05 mydir
Note the SGID bit. So, if I simply create a directory into it from the shell with mkdir test, I get
4 drwxr-sr-x 2 myuser mygroup 4096 Oct 7 16:22 test
Note that the SGID bit is inherited. But I would want it group writable (which my umask 22 does not allow) so I can simply chmod 02775 test and I am perfectly happy:
4 drwxrwsr-x 2 myuser mygroup 4096 Oct 7 16:22 test
Now I would like to do the same from a PHP script. Naturally, I would expect this to work:
mkdir("/mydir/test2");
chmod("/mydir/test2", 02775);
But it does not and I get this instead (the SGID is reset):
4 drwxrwxr-x 2 www-data mygroup 4096 Oct 7 16:30 test2
Here are a couple of other useful experiments:
mkdir("/mydir/test3");
mkdir("/mydir/test4");
passthru("chmod 02775 '/mydir/test4'");
mkdir("/mydir/test5");
passthru("chmod g+w '/mydir/test5'");
The results are
4 drwxr-sr-x 2 www-data mygroup 4096 Oct 7 16:39 test3
4 drwxrwxr-x 2 www-data mygroup 4096 Oct 7 16:39 test4
4 drwxrwxr-x 2 www-data mygroup 4096 Oct 7 17:06 test5
Interestingly, mkdir() alone has preserved the SGID, but chmod() resets it, even through passthru().
I know that the PHP manual says for chmod that the command expects only three octal digits, but I read also this stackoverflow question and it looks like the manual contains obsolete information and others can affect the SGID. Besides, it should not affect the passthru() versions, should it? The same stackoverflow question mentions something about chmod() needing to be "the last to be called" after chown() and chgrp(), but I am not using any of those.
What am I doing wrong?
In the end, the only way I could find to obtain the permissions I need is to profit of the correct behaviour of mkdir() and avoid calling chmod() which appears to reset the SGID bit no matter what. The only way I can think of doing this is to change the umask with umask():
$myumask = umask(2);
mkdir("/mydir/test6");
umask($myumask);
This appears to work fine:
4 drwxrwsr-x 2 www-data mygroup 4096 Oct 9 14:22 test6
This leaves me with the issue raised in the note of https://www.php.net/manual/en/function.umask.php: that all threads of a multithreaded webserver share the same umask, obviously leading to undesired and unpredictable behaviour. Luckily, in my case, I could ascertain that all directory creations are done in a monothreaded context (essentially, on the first test run of a script) and thus I feel safe. Hence, this is a useful workaround but not a general solution.
Is this running on a web server, or just as a CLI script? If CLI, user or root?
Also, why directories? SGID is used on program files, to allow a user to run a program/script as another user, like "sudo". Have you tried testing this on files rather than directories?
I'm having a problem with getting a shell command to clear a specific product cache because the permissions in the cache folder are strictly restricted to www-data. For example, folder /var/cache/mage--a files are like these:
-rw------- 1 www-data www-data 7646 Mar 4 11:20 mage---c54_PRODUCT_CACHE_123
-rw------- 1 www-data www-data 184 Mar 4 11:20 mage---internal-metadatas---c54_PRODUCT_CACHE_123
So when the shell command runs, it calls Mage::app()->cleanCache('PRODUCT_CACHE_123'), which triggers down to _fileGetContents function defined in lib/Zend/Cache/Backend/File.php and it's unable to open the meta file in /var/cache/mage--a due to the permissions listed above.
Does anyone have a suggested fix for this?
I ended up using Redis for caches instead. This helped solve the problem as i don't need to set up file permissions for the cache folder anymore.
I have Laravel(PHP) site which is running well on a localhost as well as Hostgator Linux shared server. The website allows users to make accounts and upload images and documents in following two directories:
var/www/html/public/contents/individual/project/images
var/www/html/public/contents/individual/project/docs
Now I have moved it to Ubuntu server at DigitalOcean. Here a user can upload a document but when he uploads an image, there is an error "[object Object]". Is this related to permissions.
A command "ls -l" gives me this information on permissions:
itsme#MyWebsite:/var/www/html/public/contents/individual/project$ ls -l
total 20
drwxrwxrwx 3 www-data www-data 4096 Aug 31 04:29 cover
drwxrwxrwx 2 www-data www-data 4096 Nov 27 01:22 docs
drwxrwxrwx 3 www-data www-data 12288 Nov 27 01:23 images
The directories "docs" and "images" have same permissions and located at same level. If "docs" is taking contents why "images" does not?
Can someone help in resolving this issue.
Thanks
Thanks alot every one for the input. Sorry my question was a bit unclear. But basically it was a problem with the ownership of the directories between /var and /images. www-data was supposed to be the owner of all the directories while in my case it was root as an owner. That is why the image plugin was showing [object Object] error/message. Though, I am still not sure, why "docs" folder was working and "images" not. But now I can upload contents in both folders.
I run a third party PHP application on my local AMP stack on my Mac. I recently bought a new Mac Mini with Lion, and am trying to set it up. My previous computer was a MB air with MAMP. Now I'm using the built-in apache/php and a homebrew installed MySQL.
Here's my problem: I have a directory with symbolic links. These symlinks are to directories, and the PHP application is checking these with is_dir().
On my Lion AMP setup, this is_dir() is failing. The same setup on my Snow Leopard MAMP is_dir() works fine with my symlinks.
Here's where it gets more curious. If I do php -a (php interactive command line mode), and do is_dir() on the very same directories, it returns true. It only returns false in the context of an apache request. This makes me think it has something to do with the apache user (which is _www) not being able to access the symlinks. Troubleshooting this falls outside of my expertise.
Other notes:
Yes, I have FollowSymLinks turned on in my apache config, and in
fact, the directory where the symlinks in question reside is a
symlink itself. Apache has no problem with it. Until PHP is_dir() is
used.
No, I cannot edit the PHP application and just fall back on is_link()
and readlink().
This exact same setup worked on my Snow Leopard/MAMP setup.
Any ideas?
Ah saw your comment on changing them to 777 but still wondering why it's not working.
My solution below might not help you.
EDIT:
If you have access to /etc/apache2/httpd.conf, edit it via sudo vi /etc/apache2/httpd.conf.
Then change these 1 of these lines or both of them
User _www
Group _www
Here is an example of my directory listing.
ace:remote-app ace (git::master)$ ls -al
total 72
drwxr-xr-x 24 ace staff 816 7 Aug 00:24 .
drwxr-xr-x 11 ace staff 374 4 Aug 13:46 ..
drwxr-xr-x 3 ace staff 102 12 Jul 17:06 .bundle
drwxr-xr-x 14 ace staff 476 7 Aug 02:29 .git
-rw-r--r-- 1 ace staff 100 1 Aug 19:20 .gitignore
-rw-r--r-- 1 ace staff 9 1 Aug 19:20 .rspec
drwxrwxr-x 10 ace staff 340 14 Jul 15:58 public
Now my public directory has 775 permissions, meaning owner and group have full permissions while other users can only read and execute.
It depends if you want apache user to become ace from the default _www or the apache group to become staff from the default _www.
Once you've decided on which to change, restart apache.
/usr/sbin/apachectl graceful
And your page should now have access to the directories / files.
One thing to note is that you have to change ownership for files that have been already been written by your webpage as those have _www:_www ownership and you won't have access to them after the restart.
You can change their new ownership through this, -R is to make it recursive.
sudo chown -R newapacheuser:newapachegroup <path>
Did you check permissions/owner?
From the PHP manual: Note: The results of this function are cached.
I had a similar issue. I created the following link:
cd /home/mike/uploads
ln -s ./data /sites/www.test.com/docroot/data
Then I created a test.php file in /sites/www.test.com/docroot that just did the following:
$dir = "/sites/www.test.com/docroot/data";
"is_dir\t\t" .is_dir($dir) ."\n";
When I ran test.php from the command line, it would show up as is_dir was True, but when I loaded test.php from a browser through apache, it was False.
I went to /sites/www.test.com/docroot/data and did a
chmod -R 755 .
That didn't change anything. Then I realized, the parent to the actual symlinked dir needed proper permissions set (/home/mike/uploads). I did a chmod on that dir, and everything worked!
Check open_basedir directive in php config. That path should also be included.
In linux, you can list multiple folders by separating them with a colon.
https://www.php.net/manual/en/ini.core.php#ini.open-basedir
Is there a way to set php running under apache to create folders with the folder owned by the owner of the program that creates it instead of being owned by apache?
Using word press it creates new folders to upload into but these are owned by apache.apache and not by the site that they are running in. This also happens using ostickets. For now we have to SSH into the server and chmod the folder, but it would seem there would be a setting somewhere to override the ownership outside of any program that does it.
Safe_mode is turn on on your server. The function mkdir() creates folder with owner ("apache", "none", ..) that different of the current script owner. And scripts couldn't upload (move, copy) files into that folder with another owner (that is not like current script owner).
Disable safe_mode and that would be work.
See http://php.net/manual/en/features.safe-mode.php for details.
P.S. With enable safe_mode you can't use chmod() function in php.
Another way is to put the apache user and the "customer users" in a new group. Additional the directory should use the sticky bit SGID so each new file got the group assignment to this new group. This way the webserver and the "customer users" can work with the files without any problems
[17:57] progman#proglap /tmp/test $ ls -al /tmp/test
total 9
drwxrwsr-x 2 root users 48 Apr 1 17:55 .
drwxrwxrwt 36 root root 9264 Apr 1 17:53 ..
As you see the directory got the stick bit SGID and the owner is the "users" group in which I (progman) am. No if another user adds a file the group automatically get set to this group
[17:55] proglap ~ # touch /tmp/test/x
This is executed from root. Now we get:
[17:57] progman#proglap /tmp/test $ ls -la /tmp/test
total 9
drwxrwsr-x 2 root users 72 Apr 1 17:59 .
drwxrwxrwt 36 root root 9264 Apr 1 17:53 ..
-rw-r--r-- 1 root users 0 Apr 1 17:59 x
As you see the added file is from root, but the group is set to users and this way I can remove it
[18:00] progman#proglap /tmp/test $ rm x
rm: remove write-protected regular empty file `x'? y
[18:01] progman#proglap /tmp/test $ ls -la /tmp/test
total 9
drwxrwsr-x 2 root users 48 Apr 1 18:01 .
drwxrwxrwt 36 root root 9264 Apr 1 17:53 ..
Keep in mind that you still need to change the chmod if you want to edit the file as rw-r--r-- is just group read access. But changing the chmod, maybe even working with umask, is better than dealing with root-access and using chown.
Not directly, no. You can't "give away" ownership of a file to another user, unless you're root. You could investigate using the "AssignUserID" apache directive to force that particular vhost to run as a particular user/group. With that Apache/PHP would create any files with the appropriate ownership
Check out PHP chown() function