3

This is an embarassing question, but I can't seem to figure out the proper file permissions for my server. I want to create a directory in my public_html folder that includes read/write access for everyone so that I can easily create files there via php scripts executed when a user loads a web page.

Here's the current permissions showing:

drw-rw-rw- 2 root www-data    4096 Aug 27 19:38 TEMPFILES

When I execute a php script as a random user who is not root and not in the www-data group, I get an error "Permission denied" when trying to write a file to TEMPFILES. Why is that?

  • Use groups, do not allow access to all. – ctrl-alt-delor Aug 27 '15 at 21:46
9
chmod a+x TEMPFILES

As directories must have the eXecute bit because reasons[1]. (You may also want the sticky bit like is set on for example /tmp.)

[1] "Note that read permission for a directory and execute permission for a directory mean different things. Read permission lets us read the directory, obtaining a list of all the filenames in the directory. Execute permission lets us pass through the directory when it is a component of a pathname that we are trying to access." -- Stevens, "APUE" (first edition), chapter 4, section 5.

  • can you explain this in more detail? I will only be saving textfiles in that directory, so why do I need execute permissions? If the whole world has both write and execute permissions, this seems crazy. That's why I wanted only write and not execute permissions. What am I missing? – sunny Aug 27 '15 at 20:02
  • 1
    There must be execute permissions on all the directories /in/path/to/TEMPFILES/somefile as otherwise the program will not have permission to traverse through to somefile; the execute bit on a directory controls whether or not a path traversal is allowed. Another option would be to restrict the directory permissions to only that of the webserver, or a group containing the necessary users, if the o+rwx bits are problematic. – thrig Aug 27 '15 at 20:10
  • @thrig, you should elaborate on the s bit. – jlliagre Aug 27 '15 at 20:12
  • chmod a+X TEMPFILES is safer it will only add execute bits where needed (only for directories and files that already have it, for user). – ctrl-alt-delor Aug 27 '15 at 21:40
  • Directory permissions are about the directory not the files in it. r read: allow reading of file-name from within the directory, x execute : allow access to files in directory, w write: allow adding and removing of files in directory. – ctrl-alt-delor Aug 27 '15 at 21:42
0

Need the execute bit set for the directory

chmod 0777 TEMP FILES

The you can see the conents

  • if I do the nuclear option of 777 how do I protect my server at all from folks uploading all sorts of nasty executables? – sunny Aug 27 '15 at 20:03
  • Perhaps the poster should read the manual page – Ed Heal Aug 27 '15 at 20:05
  • 1
    P's it is the permissions for the directory not files uploaded – Ed Heal Aug 27 '15 at 20:07
  • The permissions of the directory are not inherited by the files within (unless you use FACL's with default permissions). – ctrl-alt-delor Aug 27 '15 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.