I can create a file but I can't read from it

Question

I've been using linux for a while, but I always had root access, so permission problems were no big deal. But now I don't have root access and it's driving me mad.

I have a ssh access to a web server. This means I have access to my user gabitoptalentro, and also to the apache user through PHP backticks. I have problems with some tmp folder (not /tmp). ls -l says this:

drwxrwxrwx  2 gabitoptalentro toptalentro   4096 Jun 15 19:15 tmp

When I try to touch a file (touch tmp/QQ) to create it in this folder it works (the file is created), but it doesn't show up in ls -l. Here is the entry from my ssh account:

-rw-r--r-- 1 apache apache   0 Jun 15 19:37 QQ

So the file actually belongs to apache, but apache can't read it.

I also tried to chown the whole folder to apache, but it won't let me (chown: changing ownership of ...: Operation not permitted). Wtf, it doesn't let me give my own folders to someone else?

So, do you have any idea how I can get myself out of this mess and help apache read it's own files?

Answer 1

It's possible the server is set up to use access control lists, which is an extension of the normal Unix file permissions, or SELinux based roles.

You can check the ACL on the directory like this...

> getfacl /path/to/your/tmp

You should get something like this if everything is normal...

# file: tmp
# owner: apache
# group: apache
user::rw-
group::r--
other::r--

If you see lines like the following...

user:someotheruser:---
group:someothergroup:---

...you are dealing with an ACL'd file/dir. As you can probably guess, this is letting you set rights for specific users and groups. You can change these (permissions allowing) with the command setfacl. There are also a variety of defaults possible in the ACL on the directory that would cause new files to be created with unexpected permissions.

---

If that does not do it for you, you could be dealing with role based security in SELinux. Run the command getenforce. If it is set to enforcing Apache will only be able to read files in the HTTP context.

> /usr/sbin/getenforce
Enforcing

You would need to chcon (change context) your tmp directory...

> chcon -R -t httpd_sys_content_t /path/to/your/tmp

Here's a good SELinux FAQ

Hope that helps!

Answer 2

Permissions for newly created files are set with umask. But the umask in this case looks OK.

-rw-r--r-- 1 apache apache 0 Jun 15 19:37 QQ

Signs 2,3,4 are permissions for owner, and they are rw- which means that apache can read and write these files.

Make sure you are logged as apache when you are trying to read and write.