From d50d0e61d539750b9654b3498f6a9c95361c635c Mon Sep 17 00:00:00 2001 From: Ryan Weaver Date: Thu, 30 Nov 2017 14:25:26 -0500 Subject: [PATCH 1/3] Bye bye permissions craziness --- setup/file_permissions.rst | 88 +++++--------------------------------- 1 file changed, 10 insertions(+), 78 deletions(-) diff --git a/setup/file_permissions.rst b/setup/file_permissions.rst index 89fb4157f82..fc460ad3ef7 100644 --- a/setup/file_permissions.rst +++ b/setup/file_permissions.rst @@ -1,86 +1,18 @@ Setting up or Fixing File Permissions ===================================== -One important Symfony requirement is that the ``var`` directory must be -writable both by the web server and the command line user. +In Symfony 3.x, you needed to do some extra work to make sure that your cache directory +was writable. But that is no longer true! In Symfony 4, everything works automatically: -On Linux and macOS systems, if your web server user is different from your -command line user, you need to configure permissions properly to avoid issues. -There are several ways to achieve that: +* In the ``dev`` environment, ``umask`` is used in ``bin/console`` and ``web/index.php`` + so that any created files are writable by everyone. -1. Use the same User for the CLI and the Web Server -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -Edit your web server configuration (commonly ``httpd.conf`` or ``apache2.conf`` -for Apache) and set its user to be the same as your CLI user (e.g. for Apache, -update the ``User`` and ``Group`` directives). - -.. caution:: - - If this solution is used in a production server, be sure this user only has - limited privileges (no access to private data or servers, execution of - unsafe binaries, etc.) as a compromised server would give to the hacker - those privileges. - -2. Using ACL on a System that Supports ``chmod +a`` (macOS) -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -On macOS systems, the ``chmod`` command supports the ``+a`` flag to define an -ACL. Use the following script to determine your web server user and grant the -needed permissions: - -.. code-block:: terminal - - $ rm -rf var/cache/* - $ rm -rf var/log/* - - $ HTTPDUSER=$(ps axo user,comm | grep -E '[a]pache|[h]ttpd|[_]www|[w]ww-data|[n]ginx' | grep -v root | head -1 | cut -d\ -f1) - $ sudo chmod +a "$HTTPDUSER allow delete,write,append,file_inherit,directory_inherit" var - $ sudo chmod +a "$(whoami) allow delete,write,append,file_inherit,directory_inherit" var - -3. Using ACL on a System that Supports ``setfacl`` (Linux/BSD) -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -Most Linux and BSD distributions don't support ``chmod +a``, but do support -another utility called ``setfacl``. You may need to install ``setfacl`` and -`enable ACL support`_ on your disk partition before using it. Then, use the -following script to determine your web server user and grant the needed permissions: - -.. code-block:: terminal - - $ HTTPDUSER=$(ps axo user,comm | grep -E '[a]pache|[h]ttpd|[_]www|[w]ww-data|[n]ginx' | grep -v root | head -1 | cut -d\ -f1) - # if this doesn't work, try adding `-n` option - $ sudo setfacl -dR -m u:"$HTTPDUSER":rwX -m u:$(whoami):rwX var - $ sudo setfacl -R -m u:"$HTTPDUSER":rwX -m u:$(whoami):rwX var +* In the ``prod`` environment (i.e. when ``APP_ENV`` is ``prod`` and ``APP_DEBUG`` + is ``0)``, as long as you run ``php bin/console cache:warmup``, no cache files + will need to be written to disk at runtime. .. note:: -   The first ``setfacl`` command sets permissions for future files and folders, - while the second one sets permissions on the existing files and folders. - Both of these commands assign permissions for the system user and the Apache - user. - - ``setfacl`` isn't available on NFS mount points. However, storing cache and - logs over NFS is strongly discouraged for performance reasons. - -4. Without Using ACL -~~~~~~~~~~~~~~~~~~~~ - -If none of the previous methods work for you, change the umask so that the -cache and log directories are group-writable or world-writable (depending -if the web server user and the command line user are in the same group or not). -To achieve this, put the following line at the beginning of the ``bin/console``, -``public/index.php`` and ``public/index.php`` files:: - - umask(0002); // This will let the permissions be 0775 - - // or - - umask(0000); // This will let the permissions be 0777 - -.. note:: - - Changing the umask is not thread-safe, so the ACL methods are recommended - when they are available. - -.. _`enable ACL support`: https://help.ubuntu.com/community/FilePermissionsACLs + If you decide to store log files on disk, you *will* need to make sure your + logs directory (e.g. ``var/logs``) is writable by your web server user and + terminal user. From 327db54cb15210737f3dcd0fc4e8ae8bf512671f Mon Sep 17 00:00:00 2001 From: Ryan Weaver Date: Thu, 30 Nov 2017 21:30:51 -0500 Subject: [PATCH 2/3] adding details about 777 --- setup/file_permissions.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/setup/file_permissions.rst b/setup/file_permissions.rst index fc460ad3ef7..f2e5a2634a4 100644 --- a/setup/file_permissions.rst +++ b/setup/file_permissions.rst @@ -15,4 +15,5 @@ was writable. But that is no longer true! In Symfony 4, everything works automat If you decide to store log files on disk, you *will* need to make sure your logs directory (e.g. ``var/logs``) is writable by your web server user and - terminal user. + terminal user. One way this can be done is by using ``chmod 777 -R var/logs``. + Just be aware that your logs are readable by any user on your production system. From 32a25164d4796ea56b8e5dfbb8ca73dbdfc3611b Mon Sep 17 00:00:00 2001 From: Javier Eguiluz Date: Fri, 1 Dec 2017 17:45:02 +0100 Subject: [PATCH 3/3] Minor fixes --- setup/file_permissions.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/setup/file_permissions.rst b/setup/file_permissions.rst index f2e5a2634a4..66ba709a132 100644 --- a/setup/file_permissions.rst +++ b/setup/file_permissions.rst @@ -4,16 +4,16 @@ Setting up or Fixing File Permissions In Symfony 3.x, you needed to do some extra work to make sure that your cache directory was writable. But that is no longer true! In Symfony 4, everything works automatically: -* In the ``dev`` environment, ``umask`` is used in ``bin/console`` and ``web/index.php`` +* In the ``dev`` environment, ``umask()`` is used in ``bin/console`` and ``web/index.php`` so that any created files are writable by everyone. * In the ``prod`` environment (i.e. when ``APP_ENV`` is ``prod`` and ``APP_DEBUG`` - is ``0)``, as long as you run ``php bin/console cache:warmup``, no cache files + is ``0``), as long as you run ``php bin/console cache:warmup``, no cache files will need to be written to disk at runtime. .. note:: If you decide to store log files on disk, you *will* need to make sure your - logs directory (e.g. ``var/logs``) is writable by your web server user and - terminal user. One way this can be done is by using ``chmod 777 -R var/logs``. + logs directory (e.g. ``var/log/``) is writable by your web server user and + terminal user. One way this can be done is by using ``chmod 777 -R var/log/``. Just be aware that your logs are readable by any user on your production system.