Apache2 permissions issue

Question

I have changed my DocumentRoot to /home/user/www. To achieve that I have just changed the 2 occurrences of the path at /etc/apache2/sites-available/default.

The permissions of /home/user/www are 0774. I have added the www-data user to my user's group and the owner of /home/user/www is my own user and group (user:user).

I have done that by:

sudo chmod -R 0774 www
sudo chown -R user:user www
sudo adduser www-data user

The problem is that Apache can't write to this directory. It can write only if I set www-data as owner, but if I do that, I can't write at the directory.

I have tested the permissions with:

sudo -u www-data ls /home/user/www
sudo -u www-data cat /home/user/www/some-file

and it works.

But the Wordpress I have at www can't delete or create files. Any ideas?

Answer 1

You would have been better off with the www directory at /var/www, with owner www-data and group www-data, and adding your user to the www-data group.

First, change the DocumentRoot etc back to /var/www in the apache config.

The /var/www directory (and all subdirectories in it) should be setgid, so that files and dirs are created with group www-data.

All of the following should be run as root, or with sudo:

mkdir -p /var/www

if there were any files in /home/user/www that you want to keep, move them to /var/www now with:

mv /home/user/www/* /var/www/

Now fix the permissions and ownership of the /var/www directory.

chown -R www-data:www-data /var/www
chmod -R 775 /var/www
find /var/www -type d -print0 | xargs -0r chmod g+s
adduser user www-data

The next time 'user' logins in (or runs newgrp www-data), they should have write permission in /var/www

BTW, if you want to make it easy for 'user' to find the web files, just make a symlink in their home directory:

 ln -s /var/www/ /home/user/

Answer 2

For read/write access, it is important to have execute permissions to parent directories too (in your case /home/user). Check this answer.

You are using the root at /home/user/www (which falls under user's home directory and home directories default to 700 permissions at the time of creation.Try creating the root for apache somewhere else, for example. /apache/www

Answer 3

If your distro makes use of something like SELinux or App Armor then you'll likely need to grant access to the Apache process so that it is "allowed" to access the home directory area.

SELinux Booleans

You can use this command to see the list of booleans related to httpd (Apache).

$/usr/sbin/getsebool -a | grep httpd
allow_httpd_anon_write --> off
allow_httpd_bugzilla_script_anon_write --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_nagios_script_anon_write --> off
allow_httpd_squid_script_anon_write --> off
allow_httpd_sys_script_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off
httpd_disable_trans --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> on
httpd_rotatelogs_disable_trans --> off
httpd_ssi_exec --> off
httpd_suexec_disable_trans --> off
httpd_tty_comm --> on
httpd_unified --> on

This boolean needs to be enabled:

httpd_enable_homedirs --> on

Context Labels

Additionally you need to add a SELinux context (a label) to each directory which essentially tells SELinux that this directory or file is allowed to be accessed by whatever service/daemon is associated to that label. Apache (httpd) uses this label:

httpd_sys_content_t:s0

So you need to run this command, chcon to add that label to the files/directories under /home. Only add the label to the directory where Apache will be serving files from.

$ chcon -R -t httpd_sys_content_t /home/user/www

You can confirm this worked using the -Z switch to ls, which shows you the context labels.

$ ls -Z /var/www/manual/
drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t:s0 mod

References

• 5.7. SELinux Contexts - Labeling Files