5

This is related to, but not a duplicate of, CiviCRM rebuilding templates_c with permissions.

I am using civicrm 5.1.2 / Drupal 7 / Apache / Linux.

It is best practice not to let www-data own files in the Drupal tree. By the principle of least privilege, the web server should not be allowed to write to directories that it does not need to write to. And obviously someone needs to be able to write to them so that you can log on and upgrade and so on.

So I set up the permissions as suggested here . User jane has ownership of all the files and directories apart from the files directory, which is owned by www-data.

This does not work with CiviCRM and drush.

When you do a drush cc or drush cvupdb in the command line, as jane, the templates_c and ConfigAndLog directories get files added to them with owner jane and group www-data (I have set the setgid bit in order to ensure that the group remains www-data) and they get created with group write permissions. That is all well and good - the web server has write permissions via the group, and then is able to update the files when it needs to.

But when the web server creates the files itself, it creates them with www-data as both the group and the user. This is of course all it can do. However, it does not set group write permissions. That means that the next time jane logs on to do something from the command line that writes to those directories, she can't.

What do you suggest?

0

civibuild shows a few ways to tackle this problem.

File Permission ACL's work well if they are available on your system.

Edit: You will need to set the ACLs to cover future files created in the directory as well as existing ones. For this, use the -d flag as shown here https://serverfault.com/a/445096.

Further edit: Set the ACLs on the civicrm directory above the templates_c directory. Sometimes the whole templates_c directory gets deleted and rebuilt.

  • Thanks. I went for the FACL method. I've edited the answer to include another step - you have to set the ACLs to automatically set themselves on files as they are created. – naomi Aug 12 '18 at 17:37
0

Our rule is run everything drush that touches files owned by apache as apache:

sudo -u apache drush cc all

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.