5 ms·

Reminds me of PHP back in the day. Doesn't work? chmod -R 777 /var/www

by nathancahill 10y ago

nolok 10y ago
Because that's wasn't PHP, that was (and still is) shitty devs
- deleted 10y ago
  [deleted]
ars 10y ago
That has nothing to do with PHP and everything to do with that the webserver runs as a different user than the creator of the files. Unless you have root it's rather difficult to make a directory that the webserver can write to. It's not specific to PHP, except that PHP is used for web scripting. The correct way to do it, if you don't have root is: Make a directory 777 (yes, you do need to). Have the webserver create a subdirectory owned by the webserver. Change the parent directory away from 777 to 755 or 775. Double check that no one else created something in there while it was wide open. Be aware that ALL users on that machine who can run web scripts have access to that directory. An even better way is with mpm-itk
mst 10y ago
freenode #perl still periodically has to talk somebody trying to get a CGI script running out of using 777 to avoid having to figure out permissions properly.
- rhizome 10y ago
  It's an evergreen topic, I've seen this in so many contexts in almost 20 years in IRC help channels that it's a shibboleth for rookie status in configuring systems. Not only that, but it's a communicable weakness in that it's always passed on from person to person: if you only taught yourself using Google, it's actually hard to find 777 as advice. If you see an SO comment/answer recommending 777, it's invariably downvoted into oblivion. This increased when devops came on the scene, and it was probably one of the first things that made me conclude that devops was about pushing sysadmin skills on unprepared developers. /rant
- kuschku 10y ago
  It’s also an interesting task: How do you configure a folder so that two users, who are in no common groups, can read, write and execute everything? Even if the other user uploaded it with 700 set?
  - Ded7xSEoPKYNsDd 10y ago
    If there's really no way to run these processes as the same group at least, there's always ACLs: setfacl -m u:NON-OWNER:rwX,d:u:NON-ONWER:rwX,d:u:OWNER:rwX DIR (Allows NON-OWNER to read, write, execute if already executable for anyone to that directory, and allows NON-OWNER and OWNER to do the same for newly created files.)
    - kuschku 10y ago
      I’m not sure that solves the issue of a user (user:user) uploading and creating files via SFTP, but www-data:www-data having to execute, read, and modify them.
      - Ded7xSEoPKYNsDd 10y ago
        It works pretty well for me, to get Web DAV access to my files on my NAS. The default ACLs make sure that any newly created files can be accessed by both users.

Reminds me of PHP back in the day. Doesn't work? chmod -R 777 /var/www

nolok 10y ago

Because that's wasn't PHP, that was (and still is) shitty devs

deleted 10y ago
[deleted]

ars 10y ago

That has nothing to do with PHP and everything to do with that the webserver runs as a different user than the creator of the files. Unless you have root it's rather difficult to make a directory that the webserver can write to. It's not specific to PHP, except that PHP is used for web scripting. The correct way to do it, if you don't have root is: Make a directory 777 (yes, you do need to). Have the webserver create a subdirectory owned by the webserver. Change the parent directory away from 777 to 755 or 775. Double check that no one else created something in there while it was wide open. Be aware that ALL users on that machine who can run web scripts have access to that directory. An even better way is with mpm-itk

mst 10y ago

freenode #perl still periodically has to talk somebody trying to get a CGI script running out of using 777 to avoid having to figure out permissions properly.

rhizome 10y ago
It's an evergreen topic, I've seen this in so many contexts in almost 20 years in IRC help channels that it's a shibboleth for rookie status in configuring systems. Not only that, but it's a communicable weakness in that it's always passed on from person to person: if you only taught yourself using Google, it's actually hard to find 777 as advice. If you see an SO comment/answer recommending 777, it's invariably downvoted into oblivion. This increased when devops came on the scene, and it was probably one of the first things that made me conclude that devops was about pushing sysadmin skills on unprepared developers. /rant
kuschku 10y ago
It’s also an interesting task: How do you configure a folder so that two users, who are in no common groups, can read, write and execute everything? Even if the other user uploaded it with 700 set?
- Ded7xSEoPKYNsDd 10y ago
  If there's really no way to run these processes as the same group at least, there's always ACLs: setfacl -m u:NON-OWNER:rwX,d:u:NON-ONWER:rwX,d:u:OWNER:rwX DIR (Allows NON-OWNER to read, write, execute if already executable for anyone to that directory, and allows NON-OWNER and OWNER to do the same for newly created files.)
  - kuschku 10y ago
    I’m not sure that solves the issue of a user (user:user) uploading and creating files via SFTP, but www-data:www-data having to execute, read, and modify them.
    - Ded7xSEoPKYNsDd 10y ago
      It works pretty well for me, to get Web DAV access to my files on my NAS. The default ACLs make sure that any newly created files can be accessed by both users.