1

I have a PHP script that is attempting to create a file, but it can not because of permissions. I would like to identify which user the system sees as the one requesting to create the file. I would like to know this in a general way, not just a specific solution on how to allow files to be created by PHP.

  • I'm not clear exactly you are trying to do. Can't you just have your script print the user when it runs, or otherwise record it? – Faheem Mitha Feb 5 '14 at 17:23
  • 1
    There is no POSIX-standard way to do such introspection of the credentials of a process just as it is creating a certain file. Something available almost everywhere is ps, which will show you the current uid and gid of a process, and strace, which will trace all the system calls in a process that change uids and gids and create files. Aside from those, each OS has its own methods, such as systemtap or dtrace or auditd. Could you tell us the OSes for which you want to know the answer? – Mark Plotnick Feb 5 '14 at 17:31
  • @MarkPlotnick The OS is CentOS. I've looked at auditd a little, but didn't figure out how to get it to do what I want here. – Gn13l Feb 5 '14 at 17:45
  • @FaheemMitha No I can't print the user, because in this scenario the file is not getting created. I'm new to PHP too, so I'm not sure how I would print the OS user either. – Gn13l Feb 5 '14 at 17:47
  • @Gn13l I don't see what the script being created has to do with printing the user. Have the script print the user it is running as, at the beginning of the file. Done. This should be easy to figure out how to do this, though I don't know how to do it myself, since I don't use PHP. Additionally, what does permissions does your script currently have? Give the output of ls -l scriptname. – Faheem Mitha Feb 5 '14 at 18:02
1

Unless the script is changing it's UID, which requires the script to have the SUID bit set in it's permissions, it is running as the user who invoked it. If this is a script run by a web server that would usually be the userid of the web server.

There are various ways for a script to determine what it's uid is. If the scripting language has getuid and geteuid functions available, they can be used to get the real UID and effective UID. If not, running the id command from the script (either directly, or as shell command will return the UID being used.

File creation permissions are controlled by the directory. The UID needs execute access to all the directories on the path. To create the file, the UID needs write and execute access to the containing directory. To list the created file, the UID needs read and execute access to the directory. Permissions can be gained by user, group, or other permissions.

A last ditch approach would be to change the permissions on the directory to 777 or 773 and running the script. If the script is not blocked by permissions of a directory on the path, the file will have the script's UID as the owner. Be sure to restore the original permissions after the test.

I usually use group access to permit the web server to write directories. This is done by setting the group on the directories to the group id the web server (script) runs as.

  • Why is it that it needs execute permissions to create a file? I would expect it to need only write. – Gn13l Feb 5 '14 at 17:51
  • Execute controls access to files. If you know the name you can read a file with just the execute bit set. I believe the execute bit is required to verify allow access the file, and write to create the directory entry. – BillThor Feb 5 '14 at 17:59
  • How can I find the UID of the webserver? – Gn13l Feb 6 '14 at 16:59
  • @Gn13l Usually I use the command ps -ef | less and look for the web server process(es). The command will list the userid of the process. You can grep /etc/passwd for the user id to find the UID, or use the getent command to do the lookup. – BillThor Feb 7 '14 at 23:44
  • Awesome! ps -ef | less worked great. I'm not sure which database to use for getent. grep apache /etc/passwd produced odd results, but I'm not too familiar with using grep. (Proving how much of a linux novice I am.) – Gn13l Feb 10 '14 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.