Linux – How to set default group permission in Ubuntu for www-data (apache’s user)

apache-2.2linuxUbuntuumaskwww-data

I have not been able to set a umask for www-data (apache's user).

I tried to put umask 002, like in many other examples I found, in /etc/init.d/apache2 script, or in /etc/apache2/envvars.... Then I restart my apache server.

As an example, after restarting, if I do:

sudo su - www-data
touch file

The file gets always the default rw-r–r– permissions (umask 022), while I want rw-rw-r– (umask 002).

Changing this has been up to now an impossible task in Ubuntu Hardy (8.04).

Can anybody help me please ?

Thanks

Best Answer

The umask is specific to a process, not to a user. For example, setting the umask in /etc/init.d/apache will likely make files created by apache umask 002 (assuming the process doesn't enforce specific permissions, or change the umask after you configure it in the init.d script).

However, when you sudo su - www-data, you're not setting a umask in any of the files you've sourced into your shell. You're getting the default umask at this point.

Related Solutions

Linux File Permissions – Best Way to Handle Apache 2’s www-data User in /var/www

Attempting to expand on @Zoredache's answer, as I give this a go myself:

Create a new group (www-pub) and add the users to that group

groupadd www-pub

usermod -a -G www-pub usera ## must use -a to append to existing groups

usermod -a -G www-pub userb

groups usera ## display groups for user
Change the ownership of everything under /var/www to root:www-pub

chown -R root:www-pub /var/www ## -R for recursive
Change the permissions of all the folders to 2775

chmod 2775 /var/www ## 2=set group id, 7=rwx for owner (root), 7=rwx for group (www-pub), 5=rx for world (including apache www-data user)

Set group ID (SETGID) bit (2) causes the group (www-pub) to be copied to all new files/folders created in that folder. Other options are SETUID (4) to copy the user id, and STICKY (1) which I think lets only the owner delete files.

There's a -R recursive option, but that won't discriminate between files and folders, so you have to use find, like so:

find /var/www -type d -exec chmod 2775 {} +
Change all the files to 0664

find /var/www -type f -exec chmod 0664 {} +
Change the umask for your users to 0002

The umask controls the default file creation permissions, 0002 means files will have 664 and directories 775. Setting this (by editing the umask line at the bottom of /etc/profile in my case) means files created by one user will be writable by other users in the www-group without needing to chmod them.

Test all this by creating a file and directory and verifying the owner, group and permissions with ls -l.

Note: You'll need to logout/in for changes to your groups to take effect!

Linux – In Ubuntu I make changes to php.ini but nothing happens

I've had the same problem with an earlier version of Ubuntu (12.04), Apache 2.2.22 and php5-fpm fastCGI flavour of PHP. Doing

service apache2 restart

isn't enough, because it just restarts the http server: you have to issue also the command

service php5-fpm restart

to have the application server restarted and PHP read the php.ini file again.

Best Answer

Related Solutions

Linux File Permissions – Best Way to Handle Apache 2’s www-data User in /var/www

Linux – In Ubuntu I make changes to php.ini but nothing happens

Related Topic