0

Need the internet to confirm my sanity. On a Drupal 7 site it's saying "The directory sites/default/files is not writable." So I checked every permission but I don't see the issue. Since this isn't a public server, I temporarily turned off SELinux. Another Drupal 8 site is running on the same server with the exact same permissions. What am I missing?

getenforce output:

Permissive

ps aux | grep httpd output:

root     29064  0.0  0.1 262224  6492 ?        Ss   18:26   0:00 /usr/sbin/httpd -DFOREGROUND
apache   29065  0.0  0.0 261884  3672 ?        S    18:26   0:00 /usr/sbin/httpd -DFOREGROUND
apache   29066  0.0  0.2 1188648 10040 ?       Sl   18:26   0:00 /usr/sbin/httpd -DFOREGROUND
apache   29067  0.0  0.2 1778408 8000 ?        Sl   18:26   0:00 /usr/sbin/httpd -DFOREGROUND

/sites/default/files is a symlink and the permission should be ignored

lrwxrwxrwx 1 root   root    31 Mar 18 18:14 files -> /mnt/efs/website/publicfiles/

So let's go down the tree

drwxr-xr-x 12 root root 6144 Feb 17 23:27 efs
drwxr-xr-x 4 root root 6144 Feb 17 23:28 website
drwxrwxr-x 110 apache web 141312 Mar 18 18:16 publicfiles

EDIT (from comment below): /etc/httpd/conf/httpd.conf:

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
</Directory>

<VirtualHost *:80>
... server info ...
<Directory "/var/www/html/website/public_html">
AllowOverride All
Require all granted
Options -Indexes +FollowSymLinks
</Directory>
</VirtualHost>

.htaccess:

# Follow symbolic links in this directory.
Options +FollowSymLinks
  • Can you verify what webserver you are using? And if you are using Apache, whether 'Options +FollowSymLinks' is set in the conf? – mpdonadio Mar 18 at 19:58
  • @mpdonadio Good question. Looks like that's set as well. It was set to Options FollowSymLinks for /var/www/html. My virtualhost also has AllowOverride All and the .htaccess has the same line. Just to test I added it to the virtualhost directory context and restarted. Nothing. – Aaron Chamberlain Mar 18 at 20:34
  • What about the permissions of the parent folder? E.g. does $ [sudo] chmod u+w /sites/default/ help? – 100pic Mar 19 at 3:55
0

Finally managed to solve this. The entire purpose of this cloned server was to test out speed improvements from PHP-FPM. So since PHP evaluation is essentially offloaded to PHP-FPM, it doesn't matter if httpd has permissions, it matters whether the php-fpm process has permissions.

ps aux | grep php-fpm output:

root      5744  0.0  0.3 462268 14988 ?        Ss   16:45   0:00 php-fpm: master process (/etc/php-fpm.conf)
php-fpm   5745  0.0  0.9 467332 35196 ?        S    16:45   0:00 php-fpm: pool www
php-fpm   5746  0.0  0.4 466656 16528 ?        S    16:45   0:00 php-fpm: pool www
php-fpm   5747  0.0  0.3 466656 14032 ?        S    16:45   0:00 php-fpm: pool www
php-fpm   5748  0.0  0.3 466656 14028 ?        S    16:45   0:00 php-fpm: pool www

groups php-fpm:

php-fpm : php-fpm

So the ownership of my folder as apache:web is what doesn't fit. I just added the user php-fpm to the group web and changed things back to 775.

sudo usermod -aG web php-fpm

I would love comments on pros and cons of what I see as other possible solutions, especially from a security perspective:

1) Add php-fpm to the 'web' group.

2) Make php-fpm the owner, and httpd as member of web so it can still serve the files later.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.