Joe's sad PHP permission problem (LAMP)

Question

As many PHP servers as are out there you would think that there would more guides on this topic.

Joe begins as the happy owner of a new ubuntu PC.

Joe likes Ubuntu in his coffee. Joe wants to build a website using PHP. Joe apt-get's hundreds and hundreds of libraries trying to setup Apache, PHP, and MySQL. Joe finally gets PHP setup as the sunrise knocks poor tired Joe out.

Joe wakes up with PHP working. Joe starts writing code. Joe gets errors that PHP can't create files.

This bothers Joe.

Joe naively CHMOD's the /var/www directory to 0777. PHP works and Joe is happy. Several minutes later Joe has the same problem when PHP tries to write another file.

Joe realizes this is bad.

Joe discovers chown and a group known as www-data. Joe reverses his CHMOD and chowns the /var/www to www-data. However, PHP still won't work. PHP is nobody.

Joe goes back to work for McDonalds realizing there is no hope of ever writing PHP code.

Answer 1

Nicholas sees Joe's query, and suggests perhaps creating a separate directory that PHP can write to. He notes that if Joe does not intend for Apache to serve files directly from it, then that directory should not be under anywhere Apache serves from.

He also notes that under Debian based distributions - like Ubuntu - Apache (and thus PHP) almost always run as www-data, and suggests that something strange is happening somewhere if PHP running under apache cannot write to directories writable by that group.

Rereading, Nicholas also suggests making the folder Joe wishes to write to belong to the group www-data (chgrp www-data $folder) and then writable by that group, as he thinks that when PHP is running it is possibly a member of www-data rather than running as that user.

Nicholas notes that the process of installing PHP on Ubuntu under Apache shouldn't be much more complicated than "apt-get install apache2 libapache2-mod-php5 php5 php5-mysql" and then "sudo a2enmod php5", and that if Joe had to screw around more than that it's possible that something is fundamentally wrong that is screwing up what PHP is running under.

Nicholas notes that some of this post sounds more patronising than is strictly necessary, and blames the inherited third person format.

Answer 2

Unless your PHP process is in the business of creating every single file that lives in /var/www, chown'ing /var/www to www-data is a bad idea. I'm betting that Joe has already created a directory structure under /var/www, and his PHP process is attempting to write to one of those directories owned by someone other than www-data. You should only chown www-data the directories that you need to write to - the others are better left owned as something that the web server cannot write to.

Answer 3

Does Joe know what directory the PHP script is trying to write to? That directory needs www-data permissions to write.