Permission woes again

timstring

I receive a daily .csv file that is generated on the web and downloaded to ~/Downloads. All is fine reading the file, but I want to unlink the file. When my script arrives at the 'unlink' command, I get:

Warning: unlink(Texoma_03_27_13.csv) [function.unlink]: Permission denied in /Library/WebServer/Documents/DispatchReports/ImportTOA.php on line 162

So, I looked at the permissions for ~/Downloads. They are set to '0775', with the group set to 'staff'. What do I need to change to allow my PHP script to make changes inside the ~/Dispatch folder?

tim

cretaceous

you need to set the permissions on the csv file when it is created - chmod

timstring

cretaceous;11025821 wrote:
you need to set the permissions on the csv file when it is created - chmod

Impossible. I don't generate the csv file. I've already been to the manual, hoping to answer the question myself with no luck. I tried to 'chmod' the file just before I called 'unlink' and that failed with the same error. So, I changed the permissions of the ~/Downloads to the dreaded '0777', and that worked. I was hoping to avoid that scenario. Is there a group that I can use so that PHP will have write access to the folder without letting everyone in?

sneakyimp

Whatever process generates the CSV file needs to take care to set the appropriate permissions. Or, you may be able to set the umask on ~/Downloads such that any new files created in that folder have the right permission by default. Do you own the ~/Downloads directory? If so, check out umask.

timstring

For the 3rd time, I have absolutely no control over the report I get. The file is generated by a web app about 2,000 miles from here. Since the document is produced by Winders boxes, the geeks have no concern that I'm trying to read their data with a Mac.

Yes, I own ~/Downloads. In Mac speak, '~/' refers to the user's root folder, which is short for 'ImacHD:Users:tim:'. ~/Downloads is the default directory for my Safari downloads. That folder is full of all sorts of files with all sorts of permissions. Running a mask on the folder is impractical because it would have to be run every day when my report is downloaded, and I may not be the one downloading the file. My aim is a two-click system. The first click generates and downloads the report. The second launches my php script to process the data. The only hitch is that php won't delete the report file when the routine ends.

sneakyimp

You do have some control over the delivery of the report. For example, if you own ~/Downloads, you could set this directory such that some other user had no write access and whoever is delivering this file to you would be unable to do so. The fact that the file is delivered to ~/Downloads on a mac suggests to me that somebody might be clicking around in a browser or other program to retrieve the file and this is how it ends up in ~/Downloads.

If the mac is YOURS and you have the root/administrator password, you should be able to do whatever you want with any file that happens to get delivered to the file system. If you want to delete some file in ~/Downloads, you could open a terminal window and do so with this command:

sudo rm ~/Downloads/some_file.csv

The important thing to realize is that every process runs as some particular user. On my Ubuntu machine, the web server runs as user www-data so if I access a PHP script via web server and want that script to perform any file operations, the directory or files it wants to read/write/delete must have the appropriate permissions such that www-data can perform that action. My personal user is sneakyimp -- which is distinct from www-data.

You might try listing the file on your mac using a terminal window with the ls -l command:
ls -l ~/Downloads/your_file.csv
The output of that command should describe the user and owner of the file and its permissions.

timstring

Big sigh. The report is created by a web app. I navigate to the URL, define my parameters for the report, click 'Export CSV', then, Safari (not I) directs the file to my Downloads directory. There's only 3 mouse clicks to download the file.

My web directory is 'KathyStringHD/Library/webserver/Documents/DispatchReports', which is not my Downloads folder.

Using terminal is not an option because I need the whole script inside a PHP file. As I say, what I am doing is uploading the report into a MySQL database. I may not be the one to download the file, and who knows if they know anything about terminal commands. The object is to have a script that goes into the downloads folder and when it finds a file containing a particular string, PHP will fold, spindle, mutilate, and delete that file. I am trying to make the execution of this script as hands-off as possible. The user would go into the web app, define and download the report, go into a browser, launch my home page, and click one button--all of six steps.

Back to my original question: "What group do I assign to my ~/Downloads folder, once for all, set the permissions so that PHP can r/w/e files in that folder"? Right now, permissions for the ~/Downloads folder is Me - r/w/e, Staff - r/w/e, Everyone - r/w/e. I needed to give 'Everyone' w/r/e permissions so that PHP would delete the file. I need to return the permissions such that Everyone has 'Read Only' access. BatChmod lists about 30 possible groups. Which one do I use?

bradgrafelman

timstring;11025981 wrote:
I navigate to the URL, define my parameters for the report, click 'Export CSV', then, Safari (not I) directs the file to my Downloads directory. There's only 3 mouse clicks to download the file.

Why not reduce that to zero mouse clicks and have PHP download the report instead? Doing that would not only shorten the process but even eliminate your issue altogether - PHP won't have to worry about deleting a file if it never even creates one in the first place. Even if you need to dump the contents to disk (e.g. due to size/memory issues), you could just use [man]tmpfile/man so that it gets automatically deleted after the script has finished.

timstring;11025981 wrote:
What group do I assign to my ~/Downloads folder, once for all, set the permissions so that PHP can r/w/e files in that folder"?

One of the groups to which the user account used to execute PHP scripts belongs.

sneakyimp

bradgrafelman has a good point. If you are trying to reduce mouse clicks that happen on a daily basis, investing some time in expanding your script could be a very profitable effort. Check out [man]curl[/man] which can POST data, etc. You may have to reverse engineer the page where you generate the reports a bit, but it shouldn't be too complicated.

I needed to give 'Everyone' w/r/e permissions so that PHP would delete the file.

No you didn't. When a PHP script runs, it belongs to some user. It could be your username if you are running the script or it could be your webserver user if you are running it via a web server. It would suffice to grant ownership to that other user, whoever they are.

Weedpacket

I have to point out here that in "...The file is generated by a web app about 2,000 miles from here. Since the document is produced by Winders boxes, the geeks have no concern that I'm trying to read their data with a Mac...." the geeks are right: how they generate and serve the document and what they serve it with has no bearing on the permissions used by whatever program is running on the Mac to create the file that it writes the document's contents into. Your setup shouldn't be of any concern to them and their setup shouldn't be of any concern to you. There are communication protocols in place for separating those concerns (this site usually runs on Linux - did you notice that for several months late last year it wasn't?)

sneakyimp

timstring, I have no idea what batChmod is. You would benefit from understanding how permissions work on a Mac -- they are a lot like unix permissions. You can set independent permissions for User, Group, and Everyone for a given file -- you seem to understand this.

To change the ownership of a file -- i.e., who the User and Group are, you can use the chown command. Generally speaking, you need root-level permissions on the machine in order to use the chown command.

To change the RWE permissions on a file, you don't necessarily need root level access to the machine, but you must at least own the file.

A sort of lingering question here is do you have root level access to this machine. I.e., do you have the password for it? Also, how do these guys 2000 miles away magically get the file on your machine? Sounds to me like you are using a browser to download the data from a web server yourself and so it's YOU putting the file there. Lastly, how are you executing the PHP script? Are you accessing a locally running web browser? OR are you executing the PHP script via the command line?

It's sort of hard to solve your problem when you are not being very specific about what you are doing.

timstring

You male donkeys, do I have to prove everything to you?????

Here's a screen shot of the window where my csv file is generated:
[ATTACH]4871[/ATTACH]

Two clicks to download the report--select a date and click "Export csv"

Here's a copy of my Safari prefs:
[ATTACH]4873[/ATTACH]

The downloaded csv file goes straight to ~/Downloads. With one click on my website, my script pulls the file from ~/Downloads and processes it, deleting the original file when done.

TOAScreenShot.jpg SafariPrefs.jpg

sneakyimp

timstring;11026043 wrote:
You male donkeys, do I have to prove everything to you?????

Really? So far the only thing you've conclusively proven is that you are confused about file permissions.

timstring;11026043 wrote:
Here's a screen shot of the window where my csv file is generated:

Kind of small, isn't it? What, exactly, is it a screenshot of? Did one of your buddies send you this from 2000 miles away or is this an app YOU are running on your mac?

timstring;11026043 wrote:
Two clicks to download the report--select a date and click "Export csv"

So it IS you that is generating this file on your own machine?

timstring;11026043 wrote:
Here's a copy of my Safari prefs:

So are you in fact using a browser to access a remote web server to download a file and you cannot figure out how to delete this file that you yourself have downloaded[i/]?

timstring;11026043 wrote:
The downloaded csv file goes straight to ~/Downloads. With one click on my website, my script pulls the file from ~/Downloads and processes it, deleting the original file when done.

You might consider re-reading my last post wherein I ask the following:

sneakyimp wrote:
Lastly, how are you executing the PHP script? Are you accessing a locally running web browser? OR are you executing the PHP script via the command line?

If you are clicking on "your website" this could be some other machine running somewhere out there on the internet that has nothing to do with the mac where you are downloading this file. I suspect that "your website" is in fact not a publicly available website but rather that you are accessing a web server that happens to be running on your workstation mac.

Like I said, it's hard to solve your problem when you are not being specific.

dalecosp

system("sudo rm $filename"); // the end.

Then we can start a thread with how to get PHP running under sudo and call each other names there, too. 🙂

sneakyimp

dalecosp;11026055 wrote:
system("sudo rm $filename"); // the end.
Then we can start a thread with how to get PHP running under sudo and call each other names there, too. 🙂

Unless I'm mistaken, you have to either supply a password when using sudo OR you have to add some user to the sudoers. In either case, there are security risks, no?

In tim's case, it sounds like (and I could be wrong about this) his PHP script is running via a web server (presumably Apache as part of MAMP or something) in which case the owner of the php process is Apache or www-data or something like that. Do we really want to grant a web server sudoer permission on this machine?

I'm hardly a master of *nix file systems, but seems to me that perhaps setting proper group ownership on ~/Downloads and then doing a chmod g+s might help?

See this: http://www.library.yale.edu/~lso/workstation/docs/permissions/sgid.htm

traq

I think maybe dalecosp is being just a little sarcastic.

That "solution" occurred to me too, when I was reading through this thread last night - I think you'd need to do something like

exec('echo "{root_password}" | sudo -u root -S {command}');

but you'd also need to comment out

Defaults    requiretty

in your sudoers file, and maybe other things depending on your setup.

...

Just to clarify, for anyone who might be unsure, neither of these are good ideas and are offered in jest.

dalecosp

Nah, Linux users do this all the time!!! 😃 :p

ilovelinus@tuxen  [/etc/quake]
$sudo rm -rf /*

Yes, I suppose there's some sarcasm there. However, there are certainly situations under which I'd have no problem allowing "www" into the sudoers file without a password. Of course, none of them are on a public-facing box, either 🙂

I suppose I should really go back and try and understand what the problem is, but I lost interest somewhere around "donkeys" ... 😉

timstring

This gets back to my original question for the third time now. 😃 What owner or group do I assign to a folder so that PHP can read and write to it without having to give 'everyone' access?

I may have stumbled onto a solution. PHP will read and write to a folder that has me as owner, system as an additional user, and the group 'www". I need to add the user "system" and the group "www" to the folder's permissions that I'm trying to work with, but I don't understand the "chown" command well enough to do this. Help?? Or, am I completely nuts?

traq

chown

basically, [font=monospace]chown system:www /path/to/folder[/font], though you may have to do [font=monospace]chown -R system:www /path/to/folder[/font] if you need to change the files inside also. But whenever you download the file again, the new file will probably have whatever owner/group it does now.

I'd go with bradgrafelman's suggestion, personally.

dalecosp

You need "chmod" to give permissions:

[1021] Mon 08.Apr.2013 14:58:37
[kadmin@freebsd-devel][~] touch foo; ls -l foo
-rw-r--r--  1 kadmin  wheel  0 Apr  8 14:58 foo

[1022] Mon 08.Apr.2013 14:58:43 [kadmin@freebsd-devel][~]
chmod 664 foo; ls -l foo
-rw-rw-r--  1 kadmin  wheel  0 Apr  8 14:58 foo

Now my "foo" file is writable by the wheel group ... in your case you'd want "_www" ...

http://www.dummies.com/how-to/content/who-goes-there-understanding-permissions-in-unix.html

Please excuse the implication of the link ... no offense intended. 🙂