I have a Debian test system running Nginx and PHP-FPM, and have set a system wide umask of 027 which translates to default permissions of U=RWX G=RX O= for directors and U=RWX G=R O= for new folders and files, respectively.

After running the Drupal installer and reviewing directory structure, I notice that the installer generated files directory has default permissions of U=RWX G=RWX O=RX. Any files uploaded to this directory also receive similar permissions. Why is this so? Is it hard coded into the software to provide such permissions?

It would seem that if any new folders of files created in the files directory will receive hard coded permissions, that you would need to regularly update those permissions to something of your choosing.

  • 4
    This question appears to be off-topic because it is about Debian administration, not Drupal. – Mołot Sep 4 '13 at 6:48
  • The question is about why the files directory isn't obeying site wide umask; whether the software is hard coded to set specific permissions when it is creating the directory. – filmoreha Sep 4 '13 at 9:06
  • "Installing" Drupal is just dropping files in place. If after that permissions changed, it's not a Drupal problem. If you have used OS-specific Drupal installation package, again it's OS problem. If it happens during actual Drupal usage, and has nothing to do with installation itself, or happens after dropping files, during filling installation forms in a browser, please clarify your question. – Mołot Sep 4 '13 at 9:13
  • When I say installation, I am referring to the process of running the installer. Dropping files in a folder, does not equal "installing" IMHO. Never the less, I have clarified "installation" in my question. – filmoreha Sep 4 '13 at 9:29
  • The guidelines specifically state Server Administrator or Deployment as a topic, and I would think this question is about Server Administration with regards to Drupal file/directory structure. – filmoreha Sep 5 '13 at 0:58

Yes, if Drupal has permission to write to your doc root then it will certainly create the files folder on your behalf during installation, and attempt to set sensible permissions on it (775 seems perfectly reasonable to me considering the web server itself is creating the folder). This all happens in the /includes/install.inc file.

If your server is secured correctly, though, this should not be able to happen. The web server user should not be able to write to the doc root, only to the public/private filesystems. So you would create the files folder manually, and whatever permissions you decide to grant become part of that process.

See Securing file permissions and ownership for a full set of instructions on properly securing a Drupal site.

| improve this answer | |
  • You are right, I just tested this and it solves the permissions on the files directory. However files uploaded to that directory still receive very loose permissions (664), and are owned by the webserver. Although I suppose this is by design and given its a publicly accessible folder this is all logical, and shouldn't be an issue for most people. – filmoreha Sep 5 '13 at 0:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.