Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

UPDATED FOR FURTHER CLARITY:

According to http://expressionengine.com/user_guide/installation/installation.html, it says:

For most Unix hosts the following is typical, but you may check with your host to see if more restrictive permissions can be used to allow PHP to write to files (666) and folders (777). On Windows servers the following will not apply, but you will need to ensure that the files and folders are writable by ExpressionEngine. You may need to contact your host for this.

Not sure what this means. I can change the specific files and folders to 666 and 777 respectively where I am the chown'er, but the above sounds like I need to allow PHP to do this too?

ORIGINAL QUESTION:

I need to ensure that PHP can write to specific files (666) and folders (777).

How do I do this?

share|improve this question
2  
I am not sure what problem you are trying to solve? If you can access the directory where file is located and have execute permission in it you can write to files and directories with those permissions. –  Karlson Apr 4 '12 at 15:19
    
Added further details above. –  oshirowanen Apr 4 '12 at 15:31
1  
For most Unix hosts the following is typical, but you may check with your host to see if more restrictive permissions can be used to allow PHP to write to files (666) and folders (777) -- Is there a coma missing? otherwise this phrase doesn't make any sense. Unless higher level directory is restricted you have no issue writing to world writable files or directories. –  Karlson Apr 4 '12 at 15:39
    
I just did a copy and paste from the documentation. Plus, it's the reason why I posted the question as I don't understand what that quote means... –  oshirowanen Apr 4 '12 at 15:55
1  
If you see documentation suggesting that you use 666 or 777 in relation to web files, you should probably ignore it unless there is a good reason explained. It's usually something written by someone who couldn't figure out how to set up the right permissions, and gave up and gave everyone read or write access to the files. –  jsbillings Apr 4 '12 at 19:44

3 Answers 3

Expression Engine is just like many other PHP web applications which need read+write access to some files and directories. For example, EE requires write access to its config.php and database.php files, and write access to its file upload directories.

What the documentation is stating is that, as most servers run PHP as mod_php (and so run with the permissions of the web server), and as you probably will upload your files with FTP (or similar) using your own user, those files and directories will need to be given permissions 666 (everybody can read and write) and 777 (everybody can read, write and browse).

That is not the safest way, but certainly is the easiest, specially if your are using a hosting service.

However, as the EE instructions state, ask your hosting provider, because some don't use mod_php but a fastcgi, suphp or different version. Those servers run PHP as your own user, so all files you upload are already readable and writable by PHP and by any file created by the EE scripts. In that case files and directories accessed by PHP would need to be given 600 and 700 access. Other files to be accessed directly by the web server (not the PHP runtime) would still need 666 and 777 access).

share|improve this answer

No matter who's the owner of the files, 666 permissions and 777 would be enough: the last digit makes sure that every user on the system has access. While this is the easiest way to do it, it is definitely not the safest for that exact reason.

A better way to do it

The first thing you need to understand is how Unix permissions work. In the interest of understanding the answer I gave at this link, please note that permissions can be translated to numbers:

  • 0: ---
  • 1: --x
  • 2: -w-
  • 3: -wx
  • 4: r--
  • 5: r-x
  • 6: rw-
  • 7: rwx

A chmod 666 is then equivalent to changing permissions to rw-rw-rw.

Next you have to figure out which is the user that is executing the PHP script. Normally that would be the user running your web server. Here's an example of how to do this (you can replace Apache with the name of your web server).

Once you know which is the user executing the scripts, and which's the owner of the files you mention, it is up to you to set appropriate permissions. Keep in mind that giving write access (even read) to every user on your system can be potentially disastrous.

share|improve this answer

Edit: oops, sorry, I didn't saw that this topic was pretty old. Oh well, it can help other people..

I will complete rahmu's and MV's answers with a technical solution.

Finding the web server username

Firstly you will need to know the username under your web server runs. If you are using Apache, it can be apache or httpd, www-data, etc. On most Debian-like systems, Apache is www-data.

To check it out, try :

ps aux | grep -E '[a]pache|[h]ttpd|[_]www|[w]ww-data|[n]ginx' | grep -v root | head -1 | cut -d\  -f1

Ensure that the username this command returns is coherent (for example, I use Apache 99% of time but this command returns tomcat7).


Give permissions to web server (chmod, chown)

Doing a chmod of 666 or 777 can be sufficient but is unsecure. Giving 666 or 777 permissions will give access to "others". So not just Apache, but also your grandmother and the NSA.

It is better to be more precise and giver permissions to just you and Apache, but not our grandmother. Change the group of your files to give the full control on your files to the web server. To do this, change the owner recursively :

chown -R www-data:www-data /folder/used/by/EE

Alternatively, you can keep full access on your files by changing the group only :

chown -R yourusername:www-data /folder/used/by/EE

Then, do the appropriate chmod to give the group www-data the same permissions as you. For example, if the actual mode is 640, set it to 660. See rahmu's answer for more explanations.


Give permissions to web server (ACL)

Sometimes the first solution is not sufficient. I will take the example of Symfony Framework that logs and cache a lot of datas. So it needs write access to the appropriate folder.

And the chmod/chown method may be not sufficient, when you are using in parallel the Symfony Console in CLI (under my user account) and the Web (web server user), this cause a lot of problems because Symfony is constantly modifying permissions.

In this case, we will use the ACL (Access Control List) which are a more advanced way to manage permissions.

Here the commands given by the official Symfony documentation (please adapat app/cache and app/logs to your needs) :

On a system that supports chmod +a

sudo chmod +a "www-data allow delete,write,append,file_inherit,directory_inherit" app/cache app/logs
sudo chmod +a "`whoami` allow delete,write,append,file_inherit,directory_inherit" app/cache app/logs

On a system that does not support chmod +a

You will need the setfacl tool, maybe it is installed on your system by default. Otherwise, follow the Ubuntu documentation.

sudo setfacl -R -m u:"www-data":rwX -m u:`whoami`:rwX app/cache app/logs
sudo setfacl -dR -m u:"www-data":rwX -m u:`whoami`:rwX app/cache app/logs
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.