I have this filesystem

$ ls -la /var/www/myapp/api/project/files/
total 12
drwxrwxr-x  3 me me 4096 Jun 17 14:28 .
drwxrwxr-x 10 me me 4096 Jun 17 14:27 ..
drwxrwxr-x  2 me me 4096 Jun 17 14:28 cache

I have added www-data to my group (sudo usermod -a -G me www-data)

$ getent group me

And my web server is telling me

Error: Can not create directory

Why is my web server, running as www-data, unable to write when permissions are set as 775?

  • 2
    Did you restart apache so that the www-data user would see the new group membership? – ivanivan Jun 17 at 15:02
  • @ivanivan yes I did, multiple times just to be sure. – php_nub_qq Jun 17 at 15:37
  • Do you knew what user and group the server is started as. Is it started as a normal user, so gets all of the groups? You are correct in saying that I miss-understood in my previous answer. I added a new answer. It come down to the same advice, but for a different reason – ctrl-alt-delor Jun 17 at 15:52
  • Are you sure www-data has access (+x). to any component, starting with /var? (maybe obvious, but always useful to double check). Try increasing your webserver logging so that you get more information. Try manually to switch to www-data (sudo/su) and create the directory you may get better error message... – Patrick Mevzek Jun 17 at 17:32
  • @PatrickMevzek I just checked, every node starting from var has 5 as global permissions which is rx. Oddly enough, today it's working without me touching anything overnight.. – php_nub_qq Jun 18 at 8:43

Making it a member of your group is not a good idea. This way it can read and write all of you files. Some external entity may discover a way to trick it into reading or writing your files.

Instead give it permission no read/write the directory. Change the group of the web-server directory /var/www/myapp/api/project/files/cache/.

  • I can easily fix the problem by changing the ownership of the node, my question is why it's not working the way it is, as it should be. I'm not worried about the webserver having access to my home directory because this machine is solely made to serve this website, but that's outside of the scope of the question. – php_nub_qq Jun 17 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.