Drupal Less cache keeps generating cache file that does allow access to the apache server

Question

How do I ensure that auto-generated css cache files (related to the Less module) are being generated with the permissions necessary for the server to access.

Currently, whenever I clear all caches (with drush cc all), I lose all of my site's css styles and get the following error:

LESS could not create a directory in sites/default/files/less/52741f7e343834.56376384/sites/all/themes/my_custom_theme/css

When I go to look at the permissions (ls -l) for the files in sites/default/files/less, the directory 52741f7e343834.56376384 (which I assume is the new cache file the server is trying to create the other stuff in) it has the wrong ownership <correct-user>:<correct-user>, rather than <correct-user>:apache (it's centos, so that's the apache server group). All the other cache directories have the correct owner permissions.

So how do I ensure that the system is creating these cache files properly such that I don't have to set the file ownership every time I clear the cache to get my styles back?

This is a new problem for my site and I suspect it is because I updated the Less module for Drupal 6 and added the lessphp library to my site (though perhaps I am mistaken).

Answer 1

I do three things.

1. I put myself in the apache group.
2. Set my umask and the httpd process to 0022
3. chmod sites/default/files to 2775

The first step lets me write to the directory. The second step makes sure that files I create have group write permission, and that apache does the same. The third step tells the OS to always use the group of the directory owner.

You should then be able to drush cc all and have Apache create the LESS files.

For your initial fix, you may have to fix up the perms recursively. Eg,

chown -R apache.apache docroot/sites/default/files/
find docroot/sites/default/files/ -type d -exec chmod 2775 {} \;
find docroot/sites/default/files/ -type f -exec chmod 664 {} \;

I would also suggest reading Securing file permissions and ownership. The comments have a good duscussion about the setgid bit and potential downfalls.