Php – Using crontab to delete tmp folder files created by apache user

apache-2.2cronpermissionsPHP

Currently I have it set up such that users can download zip files from my site, and they're stored in /tmp/zip_file_dir/. The PHP script first downloads them from my CDN using ftp_get() and then places them in that folder such as /tmp/zip_file_dir/random_hash_folder/file_here.zip. Then I simply use readfile() to initiate the download for the user. That all works fine.

However, I then later use a cronjob to clear this folder out (the script deletes the downloads after readfile(), but if the user cancels the download script the files aren't deleted by it hence the point of the cronjob to clean these up).

The file_here.zip file has the permissions -rw-r--r-- with the owner apache. Each random_hash_folder in zip_file_dir has the permissions drwxr-xr-x with the owner apache. The cronjob simply scans the zip_file_dir and uses rmdir() and unlink() to delete the files.

The cronjob is run by a user with sudo access to the server (i.e. more permissions and abilities than the apache user). However, I keep getting PHP "Permission denied" notices when trying to delete the files.

I've tried added the sudo user running the cron job to the apache and nobody groups as mentioned elsewhere in some of my Google research, but that hasn't brought me any luck.

Any ideas how I get this cronjob to delete those files?

Edit: I am using RHEL.

Best Answer

You don't need any more permissions and abilities than the Apache user. Since the apache user created those files, the apache user can destroy them. The apache user seems like the most appropriate user to me.

You can either put your cron job in the apache user's crontab ( sudo crontab -u apache -e) or run the job from root's crontab as the apache user:

1 5 * * * su apache -c "/path/to/cleanup_script.php"

Choose the option that helps you keep track of your cron jobs the easiest.

Related Solutions

Linux File Permissions – Best Way to Handle Apache 2’s www-data User in /var/www

Attempting to expand on @Zoredache's answer, as I give this a go myself:

Create a new group (www-pub) and add the users to that group

groupadd www-pub

usermod -a -G www-pub usera ## must use -a to append to existing groups

usermod -a -G www-pub userb

groups usera ## display groups for user
Change the ownership of everything under /var/www to root:www-pub

chown -R root:www-pub /var/www ## -R for recursive
Change the permissions of all the folders to 2775

chmod 2775 /var/www ## 2=set group id, 7=rwx for owner (root), 7=rwx for group (www-pub), 5=rx for world (including apache www-data user)

Set group ID (SETGID) bit (2) causes the group (www-pub) to be copied to all new files/folders created in that folder. Other options are SETUID (4) to copy the user id, and STICKY (1) which I think lets only the owner delete files.

There's a -R recursive option, but that won't discriminate between files and folders, so you have to use find, like so:

find /var/www -type d -exec chmod 2775 {} +
Change all the files to 0664

find /var/www -type f -exec chmod 0664 {} +
Change the umask for your users to 0002

The umask controls the default file creation permissions, 0002 means files will have 664 and directories 775. Setting this (by editing the umask line at the bottom of /etc/profile in my case) means files created by one user will be writable by other users in the www-group without needing to chmod them.

Test all this by creating a file and directory and verifying the owner, group and permissions with ls -l.

Note: You'll need to logout/in for changes to your groups to take effect!

Linux – Remove files with PHP owned by different user

When I have to things from PHP that require root privileges on a system that has mod_php I usually write a small helper script to actually do the task. Then I use system() or proc_open() to call the script via sudo. You will need to configure your apache user account to be able to run that particular script with no password.

If the system has the cli version of php installed then you can write your helper script in PHP since it sounds like that is familiar to you.

/etc/sudoers looks like this:

Cmnd_Alias PHPHELPER=/path/helper-script 
www-data ALL=NOPASSWD: PHPHELPER

The advantage of doing this is that you can write a very tight and specific helper script that only performs one task, and you can add lots of good error checking to prevent badness. This minimizes the potential for a system compromise.

Best Answer

Related Solutions

Linux File Permissions – Best Way to Handle Apache 2’s www-data User in /var/www

Linux – Remove files with PHP owned by different user

Related Topic