0

I have an issue where I want to connect a very old system (UNIX) to a new machine. This old machine logs in by scp using a hardcoded oldsystemaccess user and copies a file into a subdirectory of the new servers webroot /var/www/newserver/test/import. The new machine is running an Ubuntu 18 LAMP stack with no advanced configuration done to the apache, running as www-data in that same group.

On the new server, I added this user oldsystemaccess to the www-data group using sudo usermod -aG www-data oldsystemaccess and I changed the permissions on the directory to rwxrwxr-x with sudo chmod 775 /var/www/newserver/test/import. After this change, the file was successfully copied over to the new system.

Now the actual issue I am trying to fix: when the files are owned by oldsystemaccess my PHP scripts cannot read or handle the files properly and since I am unable to change the way the files are copied from the old server or run additional commands when they are I am looking for a way to change the files created in the directory import to be owned by www-data user and group on creation.

For now I added a crontab entry running chown -R www-data:www-data /var/www/newserver/test/import every minute but I feel like it is a really bad solution. I am looking for something like umask but for the file ownership.

6
  • Actually, I think the solution to the problem I am having is to make the files inside the directory accessible to the group by default. Something like superuser.com/questions/612771/…
    – siryx
    Dec 13, 2022 at 16:57
  • It may be even simpler than that. Read the man page for chmod and search for setuid.
    – Jim L.
    Dec 13, 2022 at 16:58
  • Yes, in theory that is exactly what I am looking for. After further reading I found out that the behaviour I desire is not commonly implemented on Linux for the setuid bit. But for setgid, it works; so maybe I can make something work with that. I will try to use an ACL when I'm back at my desk tomorrow.
    – siryx
    Dec 13, 2022 at 17:16
  • @JimL. setuid only works on binary executables. It’s not going to have any effect on php scripts, data files, or directories.
    – doneal24
    Dec 13, 2022 at 21:22
  • @doneal24 One applies the setuid bit to the directory. Per the man page: Directories with this bit set will force all files and sub-directories created in them to be owned by the directory owner and not by the uid of the creating process, if the underlying file system supports this feature: see chmod(2)
    – Jim L.
    Dec 13, 2022 at 21:28

1 Answer 1

0

On some systems (like FreeBSD if you believe Wikipedia), the setuid bit on a directory would have my desired behaviour (Link). But since it is not default behaviour on the Ubuntu I am running I found the solution for the problem I am having was the following:

Set the setgid bit using chmod so new files are owned by the www-data group.

sudo chmod 2775 /var/www/newserver/test/import

Apparently the script copying the files has an umask of 007 set, which caused files to be created with rwxrwx--- permissions, but I overlooked this when asking the question.

If you need the write-permission bit set on files inside the directory you can then set up an ACL to automatically make files writeable by the group that owns them:

sudo setfacl -d -m group:www-data:rwx /var/www/newserver/import

3
  • That looks like it should work. Note that with chmod 4775 you are actually setting the setuid bit, not the setgid bit. Since your oldsystemaccess user is in the www-data group and the directory /var/www/newserver/test/import is group-writeable, I don't think anything else is necessary. Try removing that ACL and using just the chmod 4775 ... and it may still work. If the files created aren't group-readable, then your ACL might be needed, or an adjustment of the oldsystemaccess user's umask value would fix that, also. umask 22, for instance, rather than say, umask 77
    – Jim L.
    Dec 13, 2022 at 21:46
  • Come to think of it, if the oldsystemaccess user's primary group is www-data, and if the /var/www/newserver/import directory is group-writeable, chmod 775, and if oldsystemaccess has an effective umask 22, then neither the ACL nor the setuid will be necessary. At that point, the user will have write permission to the directory, files created will be owned oldsystemaccess:www-data and file perms will be 644.
    – Jim L.
    Dec 13, 2022 at 22:27
  • Even without the primary group changed it now apparently works.. file ownership is oldsystemaccess:oldsystemaccess and yet PHP is now able to edit, move and delete the files. I'm confused.
    – siryx
    Dec 15, 2022 at 11:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .