Apache is not creating directories with sgid enabled

Question

I added sgid recursively to the document root of my wordpress website. I can create files and directories inside with group inherited. Even directories created by FTP also working fine with sgid. But any directory created by apache (www-data) is not having sgid bit enabled so anything inside will be created with default www-data:www-data.

For example in uploads/2017 directory, apache created 09 directory without sgid. Even if I create any directory with root user here, it will have sgid enabled.

drwxrwsr-x+ 10 www-data myuser  4096 Sep 19 20:44 . 
drwxrwsr-x+ 16 www-data myuser  4096 Sep 19 20:48 ..    
drwxrwxr-x+  2 www-data myuser  4096 Sep 19 19:23 09 
drwxrwsr-x+  2 root     myuser  4096 Sep 19 21:04 test

How can we force apache to use sgid while creating new directories?

Answer 1

This is a WordPress thing, right? I was having the same problem, and I was blaming Apache as well but the solution I found was actually a WordPress setting.

See https://codex.wordpress.org/Editing_wp-config.php#Override_of_default_file_permissions

On my particular server WordPress was using its own file permission settings (and ignoring the SGID bit) the same way you were describing. I don't know what the rationale is but it seems intentional. The solution for me was to add the specific permission mask to the wp-config.php file:

define( 'FS_CHMOD_DIR', 02775 );

• 0 == octal

• 2 == set SGID

• 755 == rwxrw-rw- permissions

With the existing WordPress files and directories set with the correct permission (including SGID on all directories), new files and directories created by WordPress (plugins, themes, uploads) used the 02755 file mask and inherited the correct group ownership. NOTE the Apache user www-data has to be in the group as well.

More details:

1. created group to be used by all SFTP users and Apache: sudo groupadd sftp-grp.

2. add Apache to group sftp-grp: sudo usermod -a -G sftp-grp www-data

3. add regular users to group sftp-grp, as above.

4. set all WordPress files to be owned by Apache, but with the shared group: sudo chown -R www-data:sftp-grp /var/www/path-to-wordpress

5. make sure all WordPress files are group read/writable (may want to re-consider for .htaccess and wp-config.php): sudo chmod -R g+rw /var/www/path-to-wordpress

6. add the SGID bit to the main WordPress directory: sudo chmod g+s /var/www/path-to-wordpress

7. ... and all subdirectories: sudo find /var/www/path-to-wordpress -type d -exec chmod g+s '{}' \;

8. added to wp-config.php: define( 'FS_CHMOD_DIR', 02775 );