I've been using linux for a while, but I always had root access, so permission problems were no big deal. But now I don't have root access and it's driving me mad.

I have a ssh access to a web server. This means I have access to my user gabitoptalentro, and also to the apache user through PHP backticks. I have problems with some tmp folder (not /tmp). ls -l says this:

drwxrwxrwx  2 gabitoptalentro toptalentro   4096 Jun 15 19:15 tmp

When I try to touch a file (touch tmp/QQ) to create it in this folder it works (the file is created), but it doesn't show up in ls -l. Here is the entry from my ssh account:

-rw-r--r-- 1 apache apache   0 Jun 15 19:37 QQ

So the file actually belongs to apache, but apache can't read it.

I also tried to chown the whole folder to apache, but it won't let me (chown: changing ownership of ...: Operation not permitted). Wtf, it doesn't let me give my own folders to someone else?

So, do you have any idea how I can get myself out of this mess and help apache read it's own files?

  • What exactly is Apache complaining of? Copy-paste error messages. It's possible that CGI scripts are restricted to a part of the filesystem. – Gilles 'SO- stop being evil' Jun 15 '11 at 17:31
  • giving your files to someone else would be a security problem, for example if the setuid bit is set. – Andre Holzner Jun 17 '11 at 20:08

It's possible the server is set up to use access control lists, which is an extension of the normal Unix file permissions, or SELinux based roles.

You can check the ACL on the directory like this...

> getfacl /path/to/your/tmp

You should get something like this if everything is normal...

# file: tmp
# owner: apache
# group: apache

If you see lines like the following...


...you are dealing with an ACL'd file/dir. As you can probably guess, this is letting you set rights for specific users and groups. You can change these (permissions allowing) with the command setfacl. There are also a variety of defaults possible in the ACL on the directory that would cause new files to be created with unexpected permissions.

If that does not do it for you, you could be dealing with role based security in SELinux. Run the command getenforce. If it is set to enforcing Apache will only be able to read files in the HTTP context.

> /usr/sbin/getenforce

You would need to chcon (change context) your tmp directory...

> chcon -R -t httpd_sys_content_t /path/to/your/tmp

Here's a good SELinux FAQ

Hope that helps!

| improve this answer | |

Permissions for newly created files are set with umask. But the umask in this case looks OK.

-rw-r--r-- 1 apache apache 0 Jun 15 19:37 QQ

Signs 2,3,4 are permissions for owner, and they are rw- which means that apache can read and write these files.

Make sure you are logged as apache when you are trying to read and write.

| improve this answer | |
  • yup, whoami gives me apache. – Gabi Purcaru Jun 15 '11 at 18:18
  • Ensure that user ID apache actually has the correct path to the file. You used a relative path ("tmp/QQ") in your example. Does the process in question have a working directory of whatever "tmp/" appears in? Does the process in question try to read the file by a fully-qualified name or something else? – Bruce Ediger Jul 15 '11 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.