[RESOLVED] Cron scripts can't access Apache-generated folders

ppowell

Now I have the opposite problem. Any directory generated by my web-based application will have owner/group setting of "apache/apache". This means that my Cron scripts can't access those folders even though they have owner/group setting of "phillip/apache".

Because of this the cron scripts will not be able to do their required run. Manually running the PHP scripts comprising the cron scripts produce the same results.

The Cron scripts reside outside the docroot for security reasons.

I am not sure what to do.

Thanx
Phil

kburger

Make the diretories writable by the "apache" group.

Edit: Wait a sec. You said that your cron script was owned/grouped by phillip/apache. That's irrelevant. What user/group is EXECUTING that script? That's where you'll need to have the correct permissions set.

ppowell

User/group "phillip/apache" is executing the CRON scripts within crontab. The files and directories within the docroot will be either "phillip/apache" or "apache/apache"

Phil

kburger

OK. Then make sure those files and the directories in which they reside are writable by the group apache.

ppowell

They are writeable by the apache group. That's just it!

kburger

The files AND the directories in which those files reside are writable by the group "apache"?

ppowell

Yes. if I do this:

 $dirID = opendir($dir);

Upon this folder per se:

/var/www/html/tools/app/images
drwxrwx--- phil_made_this_folder phillip apache

It's totally OK

But on this one:

/var/www/html/tools/app/images
drwxrwx--- the_app_made_this_folder apache apache

It throws the "Permission Denied" warning, even though the folder is fully as group accessible as the other folder that throws no warning.

And again, the CRON scripts all have "phillip/apache" owner/group relationships.

Phil

kburger

Hmmm... That looks like it should be OK. I don't know. You wouldn't happen to be running SELinux, would you? Could that be it?

Anybody else have any ideas?

ppowell

Nope, Fedora Core 4.

Phil

kburger

Then that would be yes, unless you turned it off. It's on by default in FC4.

ppowell

Possibly.. I didn't install FC4, the sysadmin did that (I don't have the rights on that machine to do so), so I'm afraid I'm in the dark on that one.

Could that be a factor, if so, how?

Phil

kburger

Here's what I Googled up. Look at the bottom of this page.

ppowell

Thanx.. I understand the part about the basic filesystem permission chain from the root on down (I checked and apache has full access all the way down the line as part of the group "apache"), however, the part that goes into SELinux (the last two links) is Greek to me and couldn't find where it specifically stated anything related to my problem, at least as far as I could translate. Could you help?

Thanx
Phil

kburger

The easy solution is to use system-config-securitylevel, or have your admin do this, to turn off SELinux for the httpd daemon. I think it's in either /usr/sbin or /usr/bin.

ppowell

I think I might have the issue "resolved". I talked with a UNIX guru I know who told me that while the CRON scripts are set up right, and the directories under the docroot are set up right, this is what's happening:

crontab -e => will run the CRON as "phillip/phillip", which can access "phillip/apache" directories and files, but not "apache/apache" directories nor files.

My DEFAULT user group for my user "phillip" is not "apache", which means each time I run the CRON scripts, they run under "phillip/phillip" due to the default user group of "phillip" being "phillip" and not "apache", thus, I must have my default user group changed to "apache".

Either that, or the sysadmin must run my crontab as "root".

Phil

kburger

Yep. That would explain it.