3

I recently switched to Ubuntu. One of the tools I frequently used was XAMPP. When I installed LAMP stack on Ubuntu I noticed a major performance increase and was quite please with it. However, after literally spending days and reading dozen of how-to articles, I still couldn't set it up right.

I ended up installing apache2 + php5-fpm because it cane execute the files with the permissions of the user.

However that didn't still quite work out for me. For example, I downloaded an archive of a popular CMS and extracted it to Apache html directory. The resulting permissions on those files are 0664 and 0700 on folders.

Apache directory rules:

<Directory "/home/myuser/www/">
    AllowOverride All
    Require all granted
    Allow from all    
</Directory>

When AllowOverride All:

[Fri Dec 12 21:16:01.037580 2014] [core:crit] [pid 23745:tid 140466931369728] 
(13)Permission denied: [client 127.0.0.1:54670] AH00529:  
/home/myuser/www/mycms/install/.htaccess pcfg_openfile: unable to check htaccess 
file, ensure it is readable and that '/home/myuser/www/mycms/install/' is executable

When AllowOverride None, apache2 runs index.php which is at root directory, but won't run /config/index.php

[Fri Dec 12 21:02:41.552369 2014] [core:error] [pid 22530:tid 140517706823424]
(13)Permission denied: [client 127.0.0.1:54465] AH00035: access to 
/install/index.php denied (filesystem path 
'/home/myuser/www/mycms/install/index.php') because search 
permissions are missing on a component of the path

I'm not too well-versed in apache directory rules yet, maybe there is some error in there. Should the index.php file be readble? The php5-fpm service runs as my user:

/etc/php5/fpm/pool.d

Line 22: user = myuser
Line 23: group = myuser

The files run when I set chmod -R 0755 www/. However, I can't keep running this command every time I add some files or when they are created by php. Isn't there a way to work without constantly tampering with the permissions? I asked a colleague and he just said: "Set the root user for php5-fpm service". However, this is more of a make-shift escape solution. I am also afraid that I may run some glob/* functions and delete files which I didn't mean to delete (has happened to me in the past).

How can I set up my LAMP stack to automatically be able to run all my files?

If there is good guide on how to set it up with suphp or some other mod, I would hapilly look at it. But it has to work all the way.

Edit

 ps aux | egrep '(apache|httpd)'
root     18763  0.0  0.1  84256  4720 ?        Ss   21:35   0:00 /usr/sbin/apache2 -k start
www-data 18767  0.0  0.1 373432  6256 ?        Sl   21:35   0:00 /usr/sbin/apache2 -k start
www-data 18768  0.0  0.1 373432  6256 ?        Sl   21:35   0:00 /usr/sbin/apache2 -k start
gskema   20515  0.0  0.0  14884  2364 pts/6    S+   21:37   0:00 grep -E --color=auto (apache|httpd)

ps aux | egrep '(php)'
gskema    8312  0.0  0.0   4448   492 ?        S    16:32   0:00 /bin/sh /opt/phpstorm/bin/phpstorm.sh
gskema    8361  8.7 31.0 4630304 1245684 ?     Sl   16:32  26:52 /usr/lib/jvm/java-8-oracle/bin/java -Xms128m -Xmx750m -XX:MaxPermSize=350m -XX:ReservedCodeCacheSize=225m -ea -Dsun.io.useCanonCaches=false -Djava.net.preferIPv4Stack=true -Djsse.enableSNIExtension=false -XX:+UseConcMarkSweepGC -XX:SoftRefLRUPolicyMSPerMB=50 -Dawt.useSystemAAFontSettings=lcd -Djb.vmOptionsFile=/opt/phpstorm/bin/phpstorm64.vmoptions -XX:ErrorFile=/home/gskema/java_error_in_WEBIDE_%p.log -Xbootclasspath/a:/opt/phpstorm/bin/../lib/boot.jar -Didea.paths.selector=WebIde80 -Didea.platform.prefix=PhpStorm -Didea.no.jre.check=true -Djb.restart.code=88 com.intellij.idea.Main
gskema    8396  0.0  0.0   4936   904 ?        S    16:32   0:00 /opt/phpstorm/bin/fsnotifier64
root     18950  0.0  0.6 348744 24312 ?        Ss   21:35   0:00 php-fpm: master process (/etc/php5/fpm/php-fpm.conf)                    
www-data 18953  0.0  0.1 348744  7836 ?        S    21:35   0:00 php-fpm: pool www                                                       
www-data 18954  0.0  0.1 348744  7836 ?        S    21:35   0:00 php-fpm: pool www                                                       
gskema   20649  0.0  0.0  14888  2364 pts/6    R+   21:40   0:00 grep -E --color=auto (php)

I ran a command and I see that there are multiple? processes running. Can someone comment on these?

2
  • As you didn't say who own the files, maybe those attribute is incorrect. You could try to correct the user and group owner running 'chown -R myuser.myuser /home/myuser/'. Or I'd suggest that you post the result of 'ls -lash /home/myuser/www' to we take a look at it.
    – diegov
    Dec 18, 2014 at 18:05
  • I own the files: gskema:gksema ang the php5-fpm is set to run as gskema
    – gskema
    Dec 18, 2014 at 19:07

1 Answer 1

3
+50

There are lots of guides there for apache2 + php-fpm setup on Ubuntu. But yes they do not speak about directory permission and I have been seeing people in my orgainzation struggling with it time to time. Here is the general setup which you should look at:

Apache should run as www-data user

The php-fpm should be running as www-data user.

www-data  1591  0.0  0.4 417116 34008 ?        S    Dec19   0:00 php-fpm: pool

The apache root directory should have your user as the owner and www-data as the group.

drwxr-xr-x 44 anirudh www-data 4096 Dec 20 10:27 www

And then add www-data group to your user.

sudo usermod -a -G www-data <your-user>

Having said that if you still want to run php-fpm as your user make sure even apache is also run as same user and then I think it should work fine.

5
  • COuld you take a look at my edit? Are there too many processes running? I still think that my problem just boils down to permissions, which are 0664 by default (when I first put my files)
    – gskema
    Dec 21, 2014 at 17:51
  • Well it seems perfect. Al you need to do is change the owner and group for the directory /home/myuser/www/ to gskema:www-data or www-data:www-data. Then add the group www-data to your user using usermod command mentioned above.
    – anirudh
    Dec 21, 2014 at 20:20
  • Also set the setgid bit on the /home/myuser/www/ directory such that all newly created files inherit this group as well. gid can be set by giving the permission 2750 recursively on the directory.
    – anirudh
    Dec 21, 2014 at 20:31
  • I understand that setgid sets group to new sub-files and sub-folders to parent's folder group, however, does it also allow these files to be executed according to the correspoding permission on the parent folder (I found this to be confusing)?
    – gskema
    Dec 21, 2014 at 21:49
  • The effect of running an executable with a setgid bit is to change the effective group ID of the process to the group of the file. So yes the files will be executed assuming the privileges of the group on file.
    – anirudh
    Dec 22, 2014 at 7:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .