0

Hello I'm using a CentOS VPS with PHP and I'm trying to create a folder using the script below:

mkdir('/home/kache407/public_html/uploads/folder', 0775);

I'm getting the below error:

Severity: Warning Message: mkdir(): Permission denied

In terminal this is the permissions I have for my directories:

drwxr-x---  7 kache407 nobody       4096 Jun  6 10:57 ./
drwx--x--x 17 kache407 kache407     4096 Jun  6 06:43 ../
drwxr-xr-x  7 kache407 kache407     4096 May 26 12:32 assets/
-rw-r--r--  1 kache407 kache407 13835284 Jun  6 06:23 assets.tar.gz
drwxr-xr-x  2 kache407 kache407     4096 May 11 04:52 cgi-bin/
-rw-r--r--  1 kache407 kache407      130 Jun  6 10:52 .htaccess
-rw-r--r--  1 kache407 kache407       14 May 11 04:38 index.html
-rwxr-xr-x  1 kache407 kache407    10294 May 16 16:58 index.php*
drwxr-xr-x 12 kache407 kache407     4096 May 11 06:35 phpMyAdmin/
drwxr-xr-x  2 kache407 kache407     4096 Jun  3 16:35 uploads/
drwxr-xr-x  3 kache407 kache407     4096 May 10 14:35 .well-known/

I don't see any permissions wrong. Any help please? Thanks

oussama kamal
  • 1,027
  • 2
  • 20
  • 44
  • Is PHP running under the user `kache407`? Seems unlikely. – Jonnix Jun 06 '17 at 15:26
  • 2
    `drwxr-x--- 7 kache407 nobody 4096 Jun 6 10:57 ./` - I'm guessing PHP is in the `nobody` group and as such doesn't have *write* permission on this directory (to be fair, it shouldn't as this looks like the docroot); and it's got *no* permissions on the `uploads` directory. – CD001 Jun 06 '17 at 15:29
  • 1
    Possible duplicate of [PHP mkdir: Permission denied problem](https://stackoverflow.com/questions/5246114/php-mkdir-permission-denied-problem) – LF00 Jun 06 '17 at 15:32
  • following in on from @CD001 set your uploads directory to `765` and `chown kache407:nobody uploads/` if you can if not you will have to use `766` – Barkermn01 Jun 06 '17 at 15:32
  • @MartinBarker - after that change of ownership it should `chmod` to `770` (there should never be any need, on a web server, for *"guest"* to have any access rights whatsoever) ... and it should probably have PHP disabled on that directory as well `php_flag engine off` you don't really want web server writable directories that can run PHP. – CD001 Jun 06 '17 at 15:36
  • @CD001 - i agree for the most part but "uploads needs a change of ownership so that the group is `nobody`" if php is writing them there they will have the owner group of `nobody` as php writing them as group nobody and everyone should have execute on a directory other wise you can't execute a `ls` – Barkermn01 Jun 06 '17 at 15:40
  • @MartinBarker ... I changed my comment slightly as you'd already covered the change of ownership ;) `chown kache407:nobody uploads` – CD001 Jun 06 '17 at 15:42
  • the change was made but the permission issue is still there: drwxrw-r-x 2 kache407 nobody 4096 Jun 3 16:35 uploads/ – oussama kamal Jun 06 '17 at 15:47
  • it is working now but with 777 as permissions after the change to nobody in group – oussama kamal Jun 06 '17 at 15:49
  • 1
    ^ you should **never** need to `777` anything; `771` at most on directories - if you need to `777` it then the ownership is wrong. `777` means *"guest"* users (anonymous FTP access for instance) have full rights to upload anything they like (e.g. a PHP file that prints your config file to the screen) and then run it by simply accessing the URL. – CD001 Jun 06 '17 at 15:55
  • `drwxrw-r-x 2 kache407 nobody 4096 Jun 3 16:35 uploads/` < you've not actually given the `nobody` group `execute` permissions (basically required for directories) - should be something like `drwxrwx---` (`770`) for instance. – CD001 Jun 06 '17 at 16:03

0 Answers0