how to write a file as owner=that folder

sfullman

Hi,

So far, I can only use php to write a file if the containing folder is either owned or grouped to "nobody" (which is what PHP runs as in my Linux server).

Then along comes "SquirrelMail" which I installed recently. With SquirrelMail, you log in with your Linux username and password to check mail. Anyone with a telnet account can log in. But I noticed the user and group of the files it creates. When you create say a new folder for mail, it saves a file in your username folder AS IF IT WAS YOU, instead of being "nobody".

Without tearing the program's code apart, how does it do that? The cool thing is, I never had to set permissions or anything.

This would really be a step forward in my programming, please let me know if you have the answer to it.

Many thanks in advance,
Sam

thorpe

My guess.... [man]chown/man.

sfullman

Hi Thorpe,

I normally thank people for guessing but the docs (that you ref'd me to) state that only the superuser can change owner. "nobody" which is at least what my php runs as is hardly a superuser. If nobody (:-) else has the answer I guess I will have to tear squirrelmail apart.

Thank you anyway,
Sam Fullman

etully

Umm... maybe Squirrel Mail runs as root? (Not likely, but it could happen). Or maybe Squirrel Mail runs as a user that has the same permissions as the folder's owner?

Before you tear SqMail apart, try some experiments with chown. For example, create a directory called test... change the ownership of that directory to sfullman.sfullman (that's owner/group). Then put a php script in that directory that creates a file and see who owns the file that your php script just created. I think the file takes owner of the directory into account - it's not always owned by "nobody". Then try that same experiment but put a chown() command in the script that creates the file. Lastly, try changing the directory ownership to nobody.nobody and then see if your php script can chown() the file it creates.

Also, there's something called umask which affects the ownership of files that are created.

All of this is a round-about way of saying that I think you will learn more by studying and experimenting with ownership and permissions than by studying SqMail.

The chown command was created for a reason and not just for people who run their PHP scripts as superuser - which you shouldn't be doing. You can use it when the conditions are right.

sfullman

Hi etully, I will certainly look at these additonal features but the bottom line is, squirrelmail is probably NOT running as root, and ANYONE with a username on my system can log in, and squirrelmail will write files and folders in THEIR HOME FOLDER in THEIR NAME, - EVEN though php (which squirrelmail is) is running as nobody. When I find hte answer I'll let everyone know but this is reeally something I need to be able to do.

Sam

etully

Sorry, I just re-read my post and maybe I wasn't being clear - I didn't really think you were running Squirrel Mail as root. I was trying to say that Squirrel Mail doesn't have some magical PHP command that allows it to override the constraints of permissions at the OS level. If there was such a command, then they would just remove ownership and permissions from Unix since they could easily be overridden by PHP. SqMail (and PHP) comes second to Unix.

The answer to the problem isn't that SqMail has the power to write to the user's directory as the user. The answer lies in the fact that either (A) the OS is assigning ownership to the file based on ownership of the directory, or (😎 the permissions of the directory are such that the user "nobody" has the right to chown (change ownership of) the file to the user who logged into SqMail. Or some combination of the two which you will understand by experimenting with permissions and directory ownership.