4

Running PHP 5.4 and Apache2 on Debian 7, with apache configured to use user www-data.

I'm trying to figure out why Wordpress cannot modify files in its directory when it has group ownership with full permissions, and seems to only work if it has user ownership.

Allow me to illustrate :


Case 1

  • Set User to root and Group to www-data:

    chown -R root:www-data /var/www/site-dir/wordpress-dir/

  • Set Permissions to read, write and execute for both user and group.

    chmod -R u=rwx,g=rwx /var/www/site-dir/wordpress-dir/

  • Current ls -l output of the Wordpress directory:

    drwxrwsr-x 5 root www-data 4096 Jul 11 15:20

  • Outcome: When trying to delete a plugin, Wordpress claims it does not have access:

    enter image description here

Case 2

  • Permissions are identical to 1, but user is set to www-data:

    chown -R www-data:www-data /var/www/site-dir/wordpress-dir/

  • Outcome: Wordpress is now able to delete the plugin:

    enter image description here


Question

I'm trying to understand what's going on here. Why does the user have to be www-data, even when using www-data as group it has full permissions?

With my (limited) understanding of linux permissions I would assume that, since the apache process running Wordpress is using the www-data user, it would have complete access to do whatever it needs to in case 1, because the group is recursively set as www-data, and group permissions are recursively set to read, write and execute.

Why does the user need to be www-data for this to work?

2
  • I suspect you're getting a different result from get_filesystem_method() in file.php, but I can't see why. You could try tracing that out in one of your pages? And does removing the group suid change things?
    – Rup
    Jul 11, 2014 at 17:20
  • I'm guessing this is because apache is executed under the user www-data and not root. In case 1, the file owner is root which is perhaps creating problems. Have you tried the same things where, in scenario 1, the user is not root?
    – Sterex
    Jul 12, 2014 at 9:45

2 Answers 2

0

duplicate? At least you can find lots of (possible) explainations and (possible) solutions here: https://stackoverflow.com/questions/640409/can-i-install-update-wordpress-plugins-without-providing-ftp-access

0

This is because in the WP_Filesystem method function in wp-admin/includes/file.php it determines the update method automatically if you have not defined the FS_METHOD in your wp-config.php.

if ( $wp_file_owner !== false && $wp_file_owner === $temp_file_owner ) 

It checks to make sure a new file created by the script has the same owner as the file.php script. However, if FS_METHOD is defined, all these checks are skipped and it basically skips down to the return call.

Another workaround is changing the ownership of file.php to be owned by your webserver. But I feel like defining the FS_METHOD constant is a better solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.