On my web server I have a directory ‘www’ that has the permission drwxrwxr-- and user:group root:www-data so that Apache can access it.
Now I have added my account to the group www-data with
sudo usermod -g www-data myuser
and if I do groups then www-data is among them, but when I try to simply cd into it I get ‘Permission denied’.
If I change the user to ‘myuser’ or set the group to some other group I'm a member of, I can get in.
Am I missing something?
Your process has its group list set at login time, so you would need to log in again for the change to take effect.
I would also suggest that you add www-data as a supplementary group rather than the primary one (which is set to a group only you are a member of. You should be able to do this with the following commands:
# Reset to your original primary group
sudo usermod -g myuser myuser
# Add an extra supplementary group
sudo usermod --append -G www-data group
If you want files you create to be readable by other members of the www-data group, adjust your umask accordingly:
umask 002
Since your primary group membership is a personal group, this shouldn't affect the security of files you create.
It is also worth setting the setgid bit on directories you'll be creating files in: this will cause files to inherit the group ownership of the parent directory:
chmod g+s www/
For me it was a different thing resulting in this error
I have user "apache" configured locally with UID=123 and in NIS directory with the same name ("apache") but different UID=456.
Depending on the start order and service dependency, local user might be used before NIS user is avaiable. That also means, when you display usernames, this will be confusing, both will appear as "apache". Only when you look at numerical UIDs (for example by doing ls -ln you will see the difference.
Example:
[root@mymachine]# ls -l
drwxr-x--- 4 apache ggg1 88 May 31 17:12 file1
drwxr-x--- 4 apache ppp2 88 May 31 17:12 file2
see the UID is different for file2 (456 instead of 123):
[root@mymachine]# ls -ln
drwxr-x--- 4 123 48 88 May 31 17:12 file1
drwxr-x--- 4 456 48 88 May 31 17:12 file2
Another problem that I had with user mismatch and resulting permission error, was when I was restricting access to files by using group "httpd". This was the primary group of user "apache" (that was displayed using id or getent)
Apache starts as root, then switches to configured user and drops permission. The user it switches to is defined in /etc/httpd/conf/httpd.conf by User parameter.
Here is the problem though - the group (GID) which the process will be running as is NOT the primary group of that user. The group is defined in the same config file by Group parameter.
So in my case it was (/etc/httpd/conf/httpd.conf):
User apache
Group apache
And the directory was granted access like this:
drwxr-x--- 4 someuser httpd 88 May 31 17:12 mydir
Because httpd (GID=444) was the primary group of that user:
[root@somemachine]# id apache
uid=48(apache) gid=444(httpd) groups=444(httpd)
It resulted in some time spent debugging until I realized that Group in config file was "apache" not "httpd".
Error from /var/log/httpd/error_log:
[Fri May 31 17:13:40.070343 2019] [authz_core:debug] [pid 2527] mod_authz_core.c(809): [client 11.22.32.21:53824] AH01626: authorization result of Require all granted: granted
[Fri May 31 17:13:40.070367 2019] [authz_core:debug] [pid 2527] mod_authz_core.c(809): [client 11.22.32.21:53824] AH01626: authorization result of <RequireAny>: granted
[Fri May 31 17:13:40.070396 2019] [core:error] [pid 2527] (13)Permission denied: [client 11.22.32.21:53824] AH00132: file permissions deny server access: /var/www/html/somedir/otherdir/css/file1.txt
I hope this helps.
To add your username to the group:
sudo usermod --append -G groupname username
To refresh your login permissions without logging out/logging in:
su - $USER
