Apache Webserver - How to write to dir/files with permissions set at 755 instead of 777

Question

I just learned to install Apache 2 on my ubuntu linux localhost for the first time. I'm making it work with PHP5.

I noticed that anytime I want to write to a file or directory, I have to chmod 777 the destination.

But from my experience working on 3rd party hosting solutions, I am generally allowed to write to files and dirs that have 755 permissions.

What can I do on my localhost so that I can write to files and dirs with 755 permissions? If the answer to this is very long, can someone send me a link to a step by step guide to do this?

Answer 1

You probably can't achieve this because the owner of the file is different than the user trying to perform an action on the file.

the permissions are:

owner-group-everyone

rwx-rwx-rwx

i.e.  111 = 7 which allows read/write and execute.  
101 = 5 which is just read and execute

you can't write to the file because your logged in user isn't part of the owner/group that has access to the file.

the final 7 (i.e. rwx-rwx-111(7)) means that globally, everyone has read/write access to that file.

how to fix this
In Linux, you can use the chown or chgrp command to achieve your desired results.

Answer 2

First, you will want to find out as which user your PHP code is running. If you are using mod_php5 (package name libapache2-mod-php5) with Apache to run with the "worker" or the "prefork" MPM, this will probably be www-data.

This is no big problem as long as you only run one web application within the server. However, if you run multiple applications (or scripts that are owned by more than one user), you are setting yourself up for all kinds of security-related "fun".

Answer 3

Here are some simple rules for web site content management (under apache) that most people should follow:

1. All content should be chown'd & chgrp'd to the same user that apache is running as. On new ubuntu installs , the user and group are both "www-data".
2. If you want to administer the serving files under your own user group, then you should add youself to the www-data group, and make sure that users in this group have read/write access to all the serving files and directories. The caveat here is that you want to make sure not to create new files as your personal account. These should still be owned by www-data. The easiest way to accomplish this is to create the file as yourself, and then chown it to www-data:www-data.

If you do these 2 things, then you should be able to write to files that are being served by apache. I'm not sure where your document root is, but something like this would likely work for most simple installs:

$ sudo usermod $USER -a -G www-data 
$ cd /var/www
$ sudo chown -R www-data:www-data .