3

Any folder than I want my php code to be able to save in or any file I want it to be able to modify has to be owned by www-data. This is annoying because everything I create or want to edit without sudo is owned by my user.

On the other hand, my school's server shows everything being owned by the user but issues like this never happen. www-data seems to have no trouble saving or modifying things despite not being owner.

How do I get my /var/www site working like this, where I can retain ownership of everything but not mess up www-data's access?

Improve this question
1

2 Answers 2

Reset to default
3

A solution which I usually go for on web servers is using ACLs. Basically, this means using additional sets of permissions, other than the usual user-group-other system. I find this particularly useful when I'm setting up restricted PHP access (for instance, using suPHP).

In order to maintain ownership on my files, I make sure they belong to me:

$ chown me:me /var/www -R

Then I give www-data read access everywhere (and access permission on directories ; finer settings might desirable sometimes).

$ setfacl -Rdm 'u:www-data:r-X' /var/www
$ setfacl -Rm 'u:www-data:r-X' /var/www

I also give write-access to Apache wherever I want it to write stuff. For instance:

$ setfacl -Rdm 'u:www-data:rwX' /var/www/uploads
$ setfacl -Rm 'u:www-data:rwX' /var/www/uploads

Note that, in order to use ACLs, you need to make sure you mounted the filesystem with the acl option. This is done in /etc/fstab:

# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/sdxy       /var            ext4    defaults,acl    0       2

(assuming /var is on a different partition, otherwise see /)

By the way on some systems, the acl option is set by default. For instance:

As of Ubuntu 14.04 and for ext4, the above is not required as acl are already default.

You can check whether ACLs are enabled on a filesystem using tune2fs (assuming an ext* FS) :

# tune2fs -l /dev/sdxy | grep acl
Default mount options: acl ...

For more information on setfacl, have a look here.

Improve this answer
0

The simplest thing that you could do (on a machine which you control) would be to

  • add the group-id of www-data to your account's groups, and make the folders group-writable, e.g., chmod 775.

  • Alternatively, you could change the DocumentRoot to point to a directory that you own, and have ensured that www-data can read (and execute scripts from).

Neither of these would be a satisfactory solution for a real server (it is not secure enough).

Improve this answer
4
  • Indeed not secure enough, www-data exists for a reason, and giving it access to web files that do not need to be written is not a good policy.
    – Rui F Ribeiro
    Feb 21, 2016 at 3:26
  • 1
    Sure: but simpler than explaining how to setup user-directories on a web-server. I've seen no usable information on that on this site. The setfacl approach is a refinement over group-id, and will be harder for OP to use usefully.
    – Thomas Dickey
    Feb 21, 2016 at 11:06
  • I used to go with this approach as well, but things get tricky when new files get in the picture. You need to use setgid on the top-level directory (to maintain group ownership) and a custom umask which grants write-access to the group. Otherwise, you'll end up chmod-ing over and over again, not to mention that www-data might also create files (uploads, cache, logs). As a example, I find Symfony development to be quite nerve-wracking in such a setup.
    – John WH Smith
    Feb 21, 2016 at 12:58
  • OP's question was in a context where only the ability to update php-scripts was needed, not to modify logfiles.
    – Thomas Dickey
    Feb 21, 2016 at 13:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .