first commit

en/wiki/wikilib.d/PmWiki.FilePermissions

@@ -0,0 +1,11 @@
+version=pmwiki-2.2.30 ordered=1 urlencoded=1
+agent=Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0
+author=simon
+charset=UTF-8
+csum=see also Cookbook/DirectoryAndFilePermissions
+host=85.171.160.186
+name=PmWiki.FilePermissions
+rev=29
+targets=
+text=(:Summary: PmWiki's settings for file and directory permissions in a typical Unix environment:)%0a%0aThis page briefly describes PmWiki's settings for file and directory permissions in a typical Unix environment.%0a%0a!! Simple installation (out of the box)%0a%0aFirst, let's look at PmWiki without any cookbook scripts loaded.  PmWiki needs to be able to write into the%0a* ''wiki.d/'' directory to be able to save pages%0a* ''uploads/'' directory to save uploads.  %0aThose are the *only* directories that need to be writable by the webserver.  %0aIt doesn't matter to PmWiki who owns or creates those directories, as long as it has write permission to them.%0a%0aEverything else should be owned by the account holder, and readable by the webserver account (but normally not writable by the webserver account).%0a%0aThat's it -- everything else depends on the specific PHP configuration and running environment, which is detailed below (and which is why there isn't a definitive answer that applies to every situation).  But the above two rules are absolute and answer 95%25 of the questions about directory permissions.      %0a%0aOn a Unix host the webserver typically runs with a userid and groupid that is different from the account holder.  Usually the webserver account is something like "nobody", "apache", "www", or "httpd".  Thus, in a standard installation, the account holder manually creates the wiki.d/ and uploads/ directories, and sets the permissions on the directories to be world-writable in order for PmWiki (running as the webserver account) to be able to create files there.%0a%0a-> [@%0a$ pwd%0a/home/pmichaud/public_html/pmwiki%0a$ mkdir uploads%0a$ mkdir wiki.d%0a$ chmod 777 uploads wiki.d        %0a$ ls -ld . uploads wiki.d%0adrwxr-xr-x   12 pmichaud pmichaud     1024 Feb 10 11:51 .         %0adrwxrwxrwx    8 pmichaud pmichaud     1024 Jan 23 11:58 uploads             %0adrwxrwxrwx    2 pmichaud pmichaud    54272 Feb 10 15:29 wiki.d      %0a@]%0a%0a!! Avoiding world-write directories%0a%0aHowever, lots of people don't like having those world-writable (rwx) permissions on the directories.  The only practical way to eliminate the world write permissions is if we can get the webserver and account holder to be the owner and group of the directories and the files within them.  Since Unix typically doesn't allow non-superusers to change ownerships of files or directories that already exist, we have to make sure they are created with the correct ownerships in the first place.%0a%0aTo get the directories to be owned by the webserver account, we let PmWiki take care of creating them.  This means we temporarily grant write permission to the parent, and then execute PmWiki to allow it to create the directories.  However, we also want the newly created directories to have the same group as the account holder, so the account holder can remove or manipulate files in the directories.  Therefore, we use Unix's ''setgid'' capability (2777 or 'rws' permissions) to cause all newly created files to inherit the same group as the parent.%0a%0aTo avoid world-write directories, use the following instructions '''instead of''' the instructions above.  If you already have created the ''wiki.d/'' and ''uploads/'' directories, use chown and chmod to match the following results.%0a%0a-> [@%0a$ pwd%0a/home/pmichaud/public_html/pmwiki%0a$ chmod 2777 .  %0a$ ls -ld .%0adrwxrwsrwx  10 pmichaud pmichaud 4096 May 28 09:55 .%0a# %3c-- execute pmwiki.php script from web browser -->%0a$ ls -ld . uploads wiki.d%0adrwxrwsrwx  10 pmichaud pmichaud 4096 May 28 09:55 .%0adrwxrwsr-x   2 nobody   pmichaud 4096 May 28 09:55 uploads%0adrwxrwsr-x   2 nobody   pmichaud 4096 May 28 09:55 wiki.d%0a$ chmod 755 .%0adrwxr-xr-x  10 pmichaud pmichaud 4096 May 28 09:55 .%0adrwxrwsr-x   2 nobody   pmichaud 4096 May 28 09:55 uploads%0adrwxrwsr-x   2 nobody   pmichaud 4096 May 28 09:55 wiki.d%0a@]%0a%0aNow the two directories are owned by 'nobody', which means the webserver can write to them.  We don't have world-writable permissions on the directories, and the account holder (pmichaud) still has write permissions to the files and directories by virtue of the group ownership and permissions.  The setgid bit also ensures that any files or subdirectories created within ''uploads/'' or ''wiki.d/'' will belong to the same (pmichaud) group.%0a%0a!! Safe mode%0aHOWEVER, if a site is running in PHP's "%25newwin%25[[http://php.net/features.safe-mode|safe_mode]]", then the "let PmWiki create the directories" solution doesn't work, as PHP will only create files in directories that are owned by the same user that owns the pmwiki.php script itself.  Thus, PmWiki (apache) ''cannot'' create the directories in this case, or safe_mode will complain when PmWiki attempts to write a file into those directories. The *only* way for things to work in safe_mode is to manually create the needed directories and set their permissions to 777, as outlined at the beginning of this section.%Line truncated
+time=1315670897