Solved

Linux File Permissions / Ownership Issue with Links

Posted on 2011-09-07
12
451 Views
Last Modified: 2012-05-12
We are running a web server with CentOS, PHP, Apache, etc.

I have a common set of files and folders for our CMS that I like to keep in one shared location.
ex: /usr/local/share/cms/core

Each user has their own hosting account at /home/username/www and I have been creating a link to the shared files with:
ln -s /usr/local/share/cms/core ./core

The shared files and folders are all owned by root:root and are set to 755.

When I am logged in via SSH as a regular user I can access the shared files location and create the link to the shared files. However, when I browse to www.domainname.com/core I get a 404. If I change the ownership of the link to root:root instead of username:username only then I can access www.domainname.com/core

PHP is set to execute as the user.

The problem is that users can't create the link and then change ownership to root. From time to time we're going to be giving 3rd parties access to specific user accounts, but I don't want to give out root access.

How can I configure this such that a link created by the user will be able to access the files in the shared location?

(Apologies if I've been vague or left out any important details. Ask away and I'll respond asap.)
0
Comment
Question by:RKFcomputers
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 3
  • +1
12 Comments
 
LVL 29

Expert Comment

by:Jan Springer
ID: 36496090
Use the alias command under each vhost config:

Alias /core /usr/local/share/cms/core
0
 

Author Comment

by:RKFcomputers
ID: 36496125
Interesting idea ... I haven't played with the alias feature before. I'll check into it a bit.
0
 

Author Comment

by:RKFcomputers
ID: 36496265
I'm not sure the alias option will work for what we're trying to do. I want the user to be able to create the link (sometimes it will have to be in a subfolder or subdomain), and sometimes it will have to be moved.

Ex: Developing new site on new.domainname.com, so create the link at /home/username/www/sub/new/core
Deploy to main site after development by moving to /home/username/www/core
0
Secure Your WordPress Site: 5 Essential Approaches

WordPress is the web's most popular CMS, but its dominance also makes it a target for attackers. Our eBook will show you how to:

Prevent costly exploits of core and plugin vulnerabilities
Repel automated attacks
Lock down your dashboard, secure your code, and protect your users

 
LVL 29

Expert Comment

by:Jan Springer
ID: 36496497
Well, if you are allowing that directive in an .htaccess file, you can always implement it in that fashion.
0
 
LVL 40

Expert Comment

by:noci
ID: 36496654
Testing in a different virtal host?   like  test.example.com in stead of www.example.com
0
 
LVL 1

Accepted Solution

by:
asmodeus66 earned 500 total points
ID: 36501628
I'd guess your apache runs as root and if my guess is correct then you need to do this

<Directory whatever/it/is>
    Options +FollowSymLinks -SymLinksIfOwnerMatch [your extra options]
</Directory>
0
 
LVL 1

Expert Comment

by:asmodeus66
ID: 36501635
0
 

Author Comment

by:RKFcomputers
ID: 36501734
@asmodeous66,

Actually, apache runs as "nobody".

Should I try setting the ownership or group of the shared files to nobody? I think we tried that option at one point, but I can take another swing at it.

0
 
LVL 29

Expert Comment

by:Jan Springer
ID: 36502737
The problem with the symlinks option is that the owner might not match.
0
 

Author Comment

by:RKFcomputers
ID: 36509595
@jesper,

You're right - that's the problem. To date, the sites only worked when the symlink was owned by "root", which a regular user can't create/set.

@asmodeus66,

I tried adding "Options +FollowSymLinks -SymLinksIfOwnerMatch" to the .htaccess file in /home/username/www and that worked!

Now, if I've read and understood correctly that can cause a bit of a performance hit, so I tried to be more specific:
<Directory /home/demoshop/www>
Options +FollowSymLinks -SymLinksIfOwnerMatch
</Directory>

Can the <Directory> commands only be used in the main conf file, or is there something wrong with my syntax? I tried a few variations, and just got the usual 500 server error :)
0
 
LVL 1

Assisted Solution

by:asmodeus66
asmodeus66 earned 500 total points
ID: 36509625
yes the <Directory> directive can only be used in main config either in server confing or in virtual host confing
http://httpd.apache.org/docs/2.0/mod/core.html#directory

while Options directive can be used in .htaccess which is basically the same as putting it in <directory path/to/htaccess/dir>
http://httpd.apache.org/docs/2.0/howto/htaccess.html
0
 

Author Closing Comment

by:RKFcomputers
ID: 36509707
We're testing this in the htaccess on a few sites now, and it appears to be working well.

I'm hesitant to make too many changes to the main httpd.conf file as we use cPanel and it tends to overwrite manual edits. Long term, we'll look into preserving the core conf changes with cPanel.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
In the first part of this tutorial we will cover the prerequisites for installing SQL Server vNext on Linux.
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question