What are the right ownership & permissions to the CakePHP app/tmp folder for production?

Question

I would like to know the answers and explanation to the following questions:

1. Which user/group should own the cake files?

2. If different, which user/group should own the app/tmp folder? (and subfolders)

3. With the right user/group, what are the correct permissions for production of both folders and files? (which also if set correctly should work on development)

4. Where is storing of uploaded files done and what ownership/permissions need to be set to that folder. Where should it be relative to app/?

I know 777 fixes errors, but I would like to set it up correctly.

I have heard 660 should be more than enough for production if everything is correctly set up.

Who needs to have read access, who needs to have write access and does anyone need execute?

Solution 1

NOTE: I think I have found the answers and since no one has written a good answer, I will write it.If you are more knowledgeable on the topic and see errors or security issues please let me know, I will correct them.

---

1) CakePHP ownership

The CakePHP files should be owned by you, the user of the machine (whatever you log in with). Do not have root as owner!

OSX: the johnsmith part of /Users/johnsmith

Linux: the johnsmith part of /home/johnsmith

---

2) app/tmp ownership.

As per CakePHP documentation:

...make sure the directory app/tmp and all its subdirectories in your cake installation are writable by the web server user.

Option 1:

The user owner needs to be apache's user. The group owner can be the group that you belong to, so that you also have access to this folder through finder/CLI. Do not have root as owner!

OSX: Apache is preinstalled on OSX lately and the default user of apache is _www. However if you are not sure you can find it out by typing terminal ps aux | grep httpd while apache runs. The last line is the command you just typed, so look above it.

Now that you know your apache user, you have to assign it to app/tmp/. You do this with the following command: sudo chown -R _www app/tmp/

Linux: The default user on linux is usually www-data with group www-data. If you are not sure, use ps aux | grep httpd to find out the user and sudo chown -R _www app/tmp/ to assign ownership to apache of that folder.

Option 2:

You can keep yourself as the user owner, but you set up the group owner to be the a group that apache belongs to. By default apache has it's own group, but you could create a new group and add apache to it.

OSX: The group of apache on OSX by default is the same os the user: _www. You then have to run the following command to se up the ownership: sudo chown -R :_www app/tmp/. Now if you check the permissions with ls -l you should see both your username (johnsmith) and the new group owner - _www.

Linux:* By default the group of apache is www-data so use the same commands to change ownership: sudo chown -R :www-data app/tmp/.

NOTE: Debian/Ubuntu use www-data, while CentOS uses apache.

---

3) Permissions

For the site to run, apache needs read and write without execute. For you to access it (assuming you are in the group that owns app/tmp) you also need read and write if you will edit manually things with terminal/finder. All other users should have no rights whatsoever. So:

OSX&Linux: sudo chmod -R 660 app/tmp/. The -R part is to do it recursively for all inside folders. The first 6 is for the user owner (OSX:_www or Linux:www-data), the second 6 is for the group owner (OSX:staff or Linux: johnsmith), the 0 is for all other users/guests.

NOTE: According to this pull request for CakePHP it looks like CakePHP 2.4 will have ability to create subfolders in app/tmp/ which means it will need a 7 instead of 6 for the user now becoming 760.

---

4) Uploads folder

If you want to upload files, you need a similar setup for the img/uploads folder, or wherever you upload. The ownership will be the same, but the permissions need to have execute rights for renaming purposes and folder creation. so the previously 660 should now be 760. Also, ideally, the uploads are out of the webroot/ directory, for which an absolute path is required.

Solution 2

For all files in app/tmp and subfolders you only need rw for the web server process and if needed to use the CLI, the console user.

If someone runs console commands with a user that has super rights or is in the wrong group it messes up things because what one creates can't be read or written from the other and then there are warning or failure messages. Some people (including me when I'm too lazy) fix that with 777 :)

Comments

[user221931]

At least in debian/ubuntu the web services are www-data not apache. Also you seem to confuse permissions for files and folders. To write a directory or file inside a folder you need just write w for that folder not execute x. Execute means to be able to list (ls) the files in the directory.

[mgPePe]

Right, apache is for centOS, i will update that. In terms of execute, doesn't mkdir() require x?

[user221931]

Well yes, to clear up because I was too fast to type and it came out wrong, you do need x to be able to get inodes inside a dir so anything that has to do with read/create/rename/delete files - including mkdir, requires x for the folder (and parent folders). Still, cake won't create directories unless they are missing for some reason (i.e. the project /tmp folder wasn't properly created with all subfolders from skeleton). So app/tmp need to be 770, files 660, recursively.