0

In order to secure data on my webserver, I have moved the PHP includes to a folder called /var/www-includes (outside of /var/www, the server root). I also ran chown root:wwwadmin and chmod 770 on that folder. When I run ls -ld on the folder, it verifies the settings: drwxrwx--- ... root wwwadmin ... www-includes Although I am able to cd to the folder from my main user (adam) who is a member of wwwadmin, I cannot view its contents in a graphical file browser. Any idea why? Edit: Also, when trying to edit the contained files in nano, it shows me an error message: Error reading /home/adam/.nano_history: Permission denied then opens the contents of the file. Is this relevant at all to what may be going on?

  • 3
    If you recently added adam to the wwwadmin group, you should log out of the account, then back in again to be able to access files under the wwwadmin group. – Graeme Mar 27 '14 at 22:37
1

Perhaps an obvious question but... did you change also the permissions of files inside the directory? In other words, did you use the "-r" (recursive) flag when issuing the chown/chmod commands?

  • It's not necessarily relevant to my question... I couldn't change current directory to that folder because of its execute permissions - nothing to do with the files. – Adam Gausmann Mar 28 '14 at 2:17
1

Maybe not an answer (as the post doesn't include enough information) but I can amend it if needed. When doing linux training courses I developed a way to quickly find the permission problem. I'm aware that you already performed some of the steps but I need to write it down in full for the sake of completeness.

  1. Switch to the user you want to use for access. Do it before doing anything else.
  2. Use id command to check your current UID and groups. Use id name-of-the-user to check the on-disk configuration. Log out and log back in if they differ and check again.
  3. Use 'ls -l' to check the target directory. Don't forget to check the character just after the permissions. There may be a dot meaning ere's a selinux context or there may be a plus sign meaning linux ACLs are set.
  4. Use 'cd' to get into the directory.
  5. Perform necessary actions on the regular files. Use touch to check write access, cat to check read access.
  6. Check whether everything works as expected on the application level (e.g. use a browser to access the URL that should result in the respective action, use your favourite editing tool that previously failed, etc)
  7. Add any of the above checks to the application level.

If any of the action fails and you have no idea why, check the logs for selinux alerts or similar. You can also try to prepend strace -o strace.log to the command line and then check the strace.log for permission denied messages. But it's all black magic until you know the exact reason for permission denied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.