0

I have a Wordpress installation that refuses to auto update using the standard update button in the dashboard. The error received is:

"Unpacking the update… The update cannot be installed because we will be unable to copy some files. This is usually due to inconsistent file permissions.: wp-admin/includes/update-core.php….. Installation Failed"

Warning: copy(/var/www/html/wp-admin/includes/update-core.php): failed to open stream: Permission denied in /var/www/html/wp-admin/includes/class-wp-filesystem-direct.php on line 281

Information about the site:

  • On Google cloud's Compute Engine
  • Appropriate public key and firewall entries to allow access for DB, ssh2, etc. from local desktop
  • Site runs with Apache, PHP 7.3, MariaDB on a Centos 7 system
  • All functions except for the update run fine. This includes all normal pages, posts, etc. and the plugin updates
  • All file permissions are set to 664, folder to 775 as recommended by Wordpress
  • In the wp-config file there is "define('FS_METHOD','direct');"
  • Wordpress user is "apache"
  • FTP user is "ftpusername"
  • ftpusername belongs to group ftpusername as does apache
  • All files and folders are owned by apache
  • All files and folder belong to group "apache"

Access to the site is by SFTP Filezilla with user "ftpusername" and private key. SSH is using MobaXterm using the same user and private key

I need to determine what user the Wordpress update process thinks it is since it is not the user that runs all the other pages and posts as I have all files and folders owner by apache.

3
  • Is your question is which user is the PHP process on your server running as? That's a question you could ask on stackoverflow without needing WordPress to be mentioned or known. The file permission setting depends a lot on the server, the recommended values may not work for you, and the values that work for you might break other peoples setup.
    – Tom J Nowell
    Apr 1 '20 at 21:04
  • I'm not asking about just PHP, I know that user. I'm asking why Wordpress fails to update. The last paragraph in my question is the true unknown..
    – Rick9004
    Apr 3 '20 at 11:23
  • The WP user doesn't know which user it is, and it doesn't check or care. All it cares about is can I write to that file, and in your case it can't. If it can't write directly it'll try to fall back to FTP and ask the user for credentials
    – Tom J Nowell
    Apr 3 '20 at 11:44
2

I need to determine what user the Wordpress update process thinks it is since it is not the user that runs all the other pages and posts as I have all files and folders owner by apache.

The WordPress update process has no idea which user it's running as, nor does it care. It doesn't even check the user, and why should it. The owner of the file and the user the PHP process is running as may differ deliberatly. If it's the wrong user then WP will neither know or be able to do anything about it.

All code ran by PHP-FPM will be running under the same user, regardless of wether it's WordPress or a quick info.php you put in the web root.

Here's your problem:

Warning: copy(/var/www/html/wp-admin/includes/update-core.php): failed to open stream: Permission denied in /var/www/html/wp-admin/includes/class-wp-filesystem-direct.php on line 281

Code running from PHP files does not have permission to modify that file. That PHP warning is from PHP itself, it's not something WordPress has output.

You need to:

  • confirm that the file is writable/deletable from the PHP process user
  • confirm that the folder is writable/deletable from the PHP process user. Just because the file permission is good doesn't mean the folder is good too
  • that the ownership of that folder is correct, both for the owning user, and the owning group. Just because the file permission and folder permissions are good, doesn't mean they apply to the PHP process user.

It's not as simple as setting the right permission number with chmod. Ownership matters hugely.

For example, 664:

enter image description here

664 is useless to you if the owner is root. apache is neither the root user or in the root group ( I'm assuming that's the case on your specific system ).

As a result, apache would fall into the other bucket, and other groups only have read access.

However, if it was owned by another user that shared the same group as apache, or if it was owned by apache itself, then 664 might work as it'd be owner or group rights that apply.

What about 775?

enter image description here

It's the same but you've made the files executable.

So there is no WordPress specific solution here to your problem, which is that the folders aren't writable by PHP scripts.


As an aside, you should be making all your WP Core files read only to the PHP user so malware can't modify them, then using an external tool to update WP, such as WP CLI on a cron job, or version control such as git.

Eitherway your problem and solution involves file/folder ownership and permissions. Perhaps your apache user isn't in the appropriate group. Maybe it doesn't own the files? Only you can tell.

2
  • Thanks... For testing I made all files and folder 777 in the site. I made sure that all users on Apache, PHP were in a common group. BTW this is a test site. Same error occurred . I would love to know the file or folder that the WP is trying to create, but I cannot determine it. WP does not issue any other error info other than the message I have already documented.
    – Rick9004
    Apr 9 '20 at 15:39
  • It tells you in the error message, /var/www/html/wp-admin/includes/update-core.php. 777 is a dangerous permission to set as it means anybody can write to that file, regardless of who they are, and anybody can execute it. E.g. JPEG files uploaded could be executed. Also, it isn't WP that is displaying the error, it's PHP. You would get the same error if Drupal or Joomla tried to write to that file. As I said in my answer, this isn't about guessing the correct 3 numbers to use. Ownership and groups are likely the problem, and you've given no info on what group the files and the user are in.
    – Tom J Nowell
    Apr 9 '20 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.