0

I have an upload directory which has information fed into it by users, each time a user registers they submit a picture which creates a folder for them in the upload directory and stores their photo(s) there. The issue is, by default this upload directory and the photos in them are 0755 and 0644 respectively and i cant quite figure out a way which will reliably change the defaults of new files and folders (umask seemsearching seemed fruitful but I thought i'd ask advice on my specific situation.)

I'd like it when a new folder is created in uploads that folder is only accessible by owner and the admin and the same for any files created in those folders. This is with the ultimate intention of making that their private "profile" area which only they and the admin can access. Any help would be greatly appreciated.

Improve this question

2 Answers 2

Reset to default
2

The permissions of new files are indeed affected by the umask of the creating process, but also limited by what permissions the process uses on the open() syscall when creating the file. (i.e. files explicitly created with limited permissions (think really private stuff like ~/.ssh/id_rsa) will never end up with wider permissions.)

Another way to modify the permissions new files will get would be to use POSIX ACLs, and the Default ACL in particular. If a directory has a default ACL, it's used for new files instead of the umask.

This would make all new files in the current directory accessible to their owners, the owner's group, a user called admin and no-one else:

$ setfacl -d -m user::rwx -m user:admin:rwx -m other::- .

Add -m group::- to also remove access from the owning group.

The permissions used when creating the file still apply, but that's not likely to be a problem for a utility made for uploading files.

Improve this answer
1
  • Thanks, i appreciate you responding. My host does not allow setfacl for some reason? I attempted to accomplish it through filezilla but when i do this it breaks the signup process as you need read and write under public so people can view what they've uploaded and to actually submit it. Are there any other ways to secure users uploads from other users and the general public?
    – Forau
    Jul 31, 2019 at 0:10
0

Create a file with any of the follwoing name

  1. .cshrc
  2. .profile
  3. .bash_profile

(these files will hidden)

and add the file content umask and save, this will keep the existing permission for the new files/folders

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .