Apache mod_wsgi, Django and project file permissions

After a few hours of pain I found a solution to this exact issue.

The problems are two: 1) the folder's permissions 2) the virtual environment

The virtual environment messes with your permissions and prevents uwsgi from creating the socket correctly - just deactivate the venv and pip install django and uwsgi system wide. There may be a way to solve this within the venv, but I don't know of any.

Then, set your django project folder's permissions to 777 (or change its owner to root).

cd into the folder and run the wsgi command as root:

sudo uwsgi --socket mysite.sock --module mysite.wsgi --chmod-socket=664 --uid www-data --gid www-data

this creates mysite.sock with owner www-data and I no longer get the permission denied error.

I hope this helps.

-edit- after some more investigation, I followed this tutorial and got it working as a systemd service without any of these issues - I guess the official tutorial takes some things for granted.

For 1: It is for security reasons not permitted to allow default execute-bits on files, and they are also not really needed. (If You want to execute the file on some machine You can change the execute bit there before execute.) It would be possible to allow ftp-users changing file permissions explicitly to have execute bits set after upload. So two options: automate on server or on client that the bits get set if You really need them on files.

Maybe You should elaborate first on why You want them 775 or such by default, then You could get an answer.

That said, You can of course compile a patched ProFTPD Yourself (which starts persmissions / umask calculation by 7 instead of 6) and set Umask Configuration to 002 for files.

http://www.proftpd.org/docs/howto/Umask.html

For 2: there are different possibilities, depends on Your exact use case. A generic solution that should work also with ProFTPD is to make a group www-data the owning group of the parent directory and set the directories Set-GID bit. Set the directory Umask in ProFTPD to 77x. This would cause all uploaded content (including created diretories) into that directory to have owner group www-data, with the directory Umask setting new directories to be group-writable.

Alternatively a ProFTPD specific approach to Force a Owner Group would be to set the UserOwner Parameter for the Directories where this shall apply (http://www.proftpd.org/docs/directives/linked/config_ref_UserOwner.html).