3

This is an embarassing question, but I can't seem to figure out the proper file permissions for my server. I want to create a directory in my public_html folder that includes read/write access for everyone so that I can easily create files there via php scripts executed when a user loads a web page.

Here's the current permissions showing:

drw-rw-rw- 2 root www-data    4096 Aug 27 19:38 TEMPFILES

When I execute a php script as a random user who is not root and not in the www-data group, I get an error "Permission denied" when trying to write a file to TEMPFILES. Why is that?

Improve this question
1
  • Use groups, do not allow access to all.
    – ctrl-alt-delor
    Aug 27, 2015 at 21:46

2 Answers 2

Reset to default
9 
chmod a+x TEMPFILES

As directories must have the eXecute bit because reasons[1]. (You may also want the sticky bit like is set on for example /tmp.)

[1] "Note that read permission for a directory and execute permission for a directory mean different things. Read permission lets us read the directory, obtaining a list of all the filenames in the directory. Execute permission lets us pass through the directory when it is a component of a pathname that we are trying to access." -- Stevens, "APUE" (first edition), chapter 4, section 5.

Improve this answer
5
  • can you explain this in more detail? I will only be saving textfiles in that directory, so why do I need execute permissions? If the whole world has both write and execute permissions, this seems crazy. That's why I wanted only write and not execute permissions. What am I missing?
    – sunny
    Aug 27, 2015 at 20:02
  • 2
    There must be execute permissions on all the directories /in/path/to/TEMPFILES/somefile as otherwise the program will not have permission to traverse through to somefile; the execute bit on a directory controls whether or not a path traversal is allowed. Another option would be to restrict the directory permissions to only that of the webserver, or a group containing the necessary users, if the o+rwx bits are problematic.
    – thrig
    Aug 27, 2015 at 20:10
  • @thrig, you should elaborate on the s bit.
    – jlliagre
    Aug 27, 2015 at 20:12
  • chmod a+X TEMPFILES is safer it will only add execute bits where needed (only for directories and files that already have it, for user).
    – ctrl-alt-delor
    Aug 27, 2015 at 21:40
  • Directory permissions are about the directory not the files in it. r read: allow reading of file-name from within the directory, x execute : allow access to files in directory, w write: allow adding and removing of files in directory.
    – ctrl-alt-delor
    Aug 27, 2015 at 21:42
0

Need the execute bit set for the directory

chmod 0777 TEMP FILES

The you can see the conents

Improve this answer
4
  • if I do the nuclear option of 777 how do I protect my server at all from folks uploading all sorts of nasty executables?
    – sunny
    Aug 27, 2015 at 20:03
  • Perhaps the poster should read the manual page
    – Ed Heal
    Aug 27, 2015 at 20:05
  • 1
    P's it is the permissions for the directory not files uploaded
    – Ed Heal
    Aug 27, 2015 at 20:07
  • The permissions of the directory are not inherited by the files within (unless you use FACL's with default permissions).
    – ctrl-alt-delor
    Aug 27, 2015 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .