2

I have the following script for setting permissions for the Joomla CMS directory:

#!/bin/bash
if [ ! -d "$1" ]; then
  echo "Error: Folder does not exist or no folder given."
  echo ""
  exit 1
fi
# XAMPP uses daemon as default www-group for Apache.
WWWGROUP="daemon"
THEUSER=`who | awk '{print $1}'`
JOOMLADIR="$1"
chown -R $THEUSER:$WWWGROUP "$JOOMLADIR"
chmod g+s "$JOOMLADIR"
find "$JOOMLADIR" -type d -exec chmod 0755 {} \;
find "$JOOMLADIR" -type f -exec chmod 0644 {} \;

setfacl -b -k "$JOOMLADIR"
setfacl -Rm u:$THEUSER:rwX "$JOOMLADIR"
setfacl -Rm g:$WWWGROUP:rX "$JOOMLADIR"
setfacl -Rm d:u:$THEUSER:rwX "$JOOMLADIR"
setfacl -Rm d:g:$WWWGROUP:rX "$JOOMLADIR"

setfacl -m m::rwx "$JOOMLADIR"

# Some folders need to be writable by the web server.
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/administrator/components"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/administrator/language"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/administrator/manifests"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/administrator/modules"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/administrator/templates"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/components"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/images"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/language"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/libraries"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/media"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/modules"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/plugins"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/templates"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/cache"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/administrator/cache"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/administrator/logs"
setfacl -Rm g:$WWWGROUP:rwX "$JOOMLADIR/tmp"
# Some extra security for configuration.php:
setfacl -m g:$WWWGROUP:r "$JOOMLADIR/configuration.php"
setfacl -m o:0000 "$JOOMLADIR/configuration.php"

If I then use that script to set permissions for the folder of which I have a listing below, why does every folder then get write permission for the daemon group? At least, it is listed as such, though the getfacl command does list permissions properly.

totaal 172
drwxrwxr-x+ 11 myuser daemon  4096 okt  4 07:52 administrator
drwxrwxr-x+  2 myuser daemon  4096 okt  4 07:52 bin
drwxrwxr-x+  2 myuser daemon  4096 okt  4 07:52 cache
drwxrwxr-x+  2 myuser daemon  4096 okt  4 07:52 cli
drwxrwxr-x+ 19 myuser daemon  4096 okt  4 07:52 components
-rw-rw-r--+  1 myuser daemon  3005 okt  4 07:52 htaccess.txt
drwxrwxr-x+  5 myuser daemon  4096 okt  4 07:52 images
drwxrwxr-x+  2 myuser daemon  4096 okt  4 07:52 includes
-rw-rw-r--+  1 myuser daemon  1420 okt  4 07:52 index.php
drwxrwxr-x+ 14 myuser daemon  4096 okt  4 07:52 installation
drwxrwxr-x+  4 myuser daemon  4096 okt  4 07:52 language
drwxrwxr-x+  5 myuser daemon  4096 okt  4 07:52 layouts
drwxrwxr-x+ 12 myuser daemon  4096 okt  4 07:52 libraries
-rw-rw-r--+  1 myuser daemon 18092 okt  4 07:52 LICENSE.txt
drwxrwxr-x+ 27 myuser daemon  4096 okt  4 07:52 media
drwxrwxr-x+ 27 myuser daemon  4096 okt  4 07:52 modules
drwxrwxr-x+ 17 myuser daemon  4096 okt  4 07:52 plugins
-rw-rw-r--+  1 myuser daemon  4872 okt  4 07:52 README.txt
-rw-rw-r--+  1 myuser daemon   836 okt  4 07:52 robots.txt.dist
drwxrwxr-x+  5 myuser daemon  4096 okt  4 07:52 templates
drwxrwxr-x+  2 myuser daemon  4096 okt  4 07:52 tmp
-rw-rw-r--+  1 myuser daemon  1690 okt  4 07:52 web.config.txt

What I am trying to achieve is this actually:

I am trying to setup an environment to develop Joomla extensions.

I'm using the Eclipse IDE with two open projects in my workspace:

  • The project which contains my extension.
  • The project which contains the Joomla CMS installation directory.

I'm also using the Phing build tool to copy files from the extension to the Joomla CMS installation directory to test code changes.

I'm also using XAMPP which bundles the Apache web server (which runs as user daemon and under group daemon) and serves files from /opt/lampp/htdocs.

Inside /opt/lampp/htdocs resides the Joomla installation directory at /opt/lampp/htdocs/joomla.

Problem is when deleting and copying the files and directories from the extension to the Joomla installation directory I get permission errors.

Why do I get permission errors? Well, that's because when I first do install my ZIP (extension/component) via the Joomla website (later on I want to be able to instantly see code changes by copying it directly from extension project to Joomla install directory) the webserver (Apache) creates the component as owner daemon and group daemon.

However, I want to give read, write and execute permissions for my own user (myuser) instead of daemon because I want to be able to delete the old set of files and directories from administrator/components/com_mycomp and components/com_mycomp (just an example).

I'm trying to follow a Joomla article here which tries and setup a development environment for extensions: https://docs.joomla.org/Extension_development_using_eclipse_and_phing

Basically I just download the Joomla ZIP file, unzip it and copy it to /opt/lampp/htdocs/joomla.

Then I run:

sudo securepermissions.sh /opt/lampp/htdocs/joomla

Then it does not output any errors except for the non-existing Joomla configuration file, which it tries to set permissions to (currently tried reinstalling, that's why there is no configuration.php yet).

So, I run ls -l inside the joomla folder and get my listing which of course shows the mask, as user @dessert explained (and which I did not know first).

But still, when I use find . -ls on the joomla folder it still shows the permissions for group daemon being rw- for files and rwx for directories, even though they haven't been set this way using the script, as far as I know.

0

1 Answer 1

2

If ACL is present, ls -l signals that with a + at the end of the permission column. Additionally it doesn't show the group permissions but the mask instead, see this example:

$ getfacl file
user::rw-
user:user:---
group::---
group:group:---
mask::rwx
other::---

$ ls -l file
-rw-rwx---+ 1 user group 0 2010-01-01 00:00 file

Source: https://wiki.ubuntuusers.de/ACL/

Besides your script can be largely simplified, see this pastie, tested with shellcheck.net.

1
  • 2
    Just the bit in bold, that should be stapled to the internet for anyone wondering - in fact, would've been nice if ls would explain that in some way.
    – kasimir
    Feb 26, 2019 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.