通过 PHP/Apache 编写的文件不支持目录 setgid 位
在这个问题上摸不着头脑，似乎很基本。
我有一个由承包商为我们的网站编写的基于 PHP 的内容管理系统。其中一项功能是能够上传图像以显示在网站上的各个位置（例如产品图库）。所有此类上传的图像都存储在称为“附件”的特定目录中。
drwxrwsr-x 4 www ftpusers 4096 Oct 10 14:47 Attachments
正如你所看到的，我已经在该目录上设置了 setgid 位，以便任何写入的文件都将拥有需要访问这些文件的用户（如 FTP 用户）的组将能够修改/覆盖它们。我已经为 Apache 设置了 umask，以便它将文件写入为组可写。
当我通过在该目录中创建新文件来对系统中的任何用户尝试此操作时，它会正确继承父组。当通过在 Apache 中运行的 PHP 创建新文件时，它始终具有 apache.apache 所有权。 Apache 似乎忽略了 setgid 位，我认为它无法做到这一点，因为这是由文件系统完成的。这是我上传的一个文件：
-rw-rw-r-- 1 apache apache 30536 Oct 10 14:43 209
我无法直接以 apache 用户身份进行测试，因为它没有指定登录 shell（出于明显的安全原因） ）。
我可以通过将 ftpusers 组添加到 apache 组来获得相同的权限功能，但从安全角度来看，这似乎并不明智。
我确实发现了一件事似乎可能相关 - php 安全模式，我已经验证它在 /etc/php.ini 中关闭，尽管我不确定我找到了 apache 中的 mod_php 的 php.ini 文件使用。 php 脚本使用 move_uploaded_file();据我所知，php 代码中没有对权限进行任何花哨的操作。
我最好的猜测是，这是对安全性的有意限制，但我找不到任何表明情况如此的信息。
使用 Apache 2.2.17 和 php 5.2.16 运行 CentOS 5.6。
有人知道吗？
Scratching my head on this one, seems so basic.
I've got a PHP based content management system for our website written by a contractor. One feature is the ability to upload images to be displayed in various places on the website (like a product gallery). All such uploaded images are stored in a particular directory called "attachments".
drwxrwsr-x 4 www ftpusers 4096 Oct 10 14:47 attachments
As you can see I've got the setgid bit set on that dir so that any files written will have the group that users (like FTP user) who need access to those files will able to modify/overwrite them. I've set the umask for Apache so that it will write files as group writable.
When I try this with ANY user in the system by creating a new file in that directory, it correctly inherits the group of the parent. When a new file is created through PHP running in Apache, it always has the apache.apache ownership. Apache seems to be ignoring the setgid bit, which I didn't think it could do as this was done by the file system. Here is one file I uploaded:
-rw-rw-r-- 1 apache apache 30536 Oct 10 14:43 209
I can't test as the apache user directly as it doesn't have a login shell specified (for obvious security reasons).
I can get the same permissions capability by adding the ftpusers group to the apache group, but this doesn't seem wise from a security perspective.
I did find one thing that seemed like it might be related - php safe mode, which I've verified is off in /etc/php.ini, although I'm not positive I found the php.ini file that mod_php in apache is using. The php script is using move_uploaded_file(); as far as I can tell, nothing fancy with permissions is being done in the php code.
My best guess would be that this is an intentional limitations for security, but I can't find anything that seems to indicate that is the case.
Running CentOS 5.6 with Apache 2.2.17 and php 5.2.16.
Anyone have a clue?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
当您上传文件时，它会在 PHP 的“upload_tmp_dir”设置指定的目录中创建。然后 move_uploaded_file() 将其移动到您的目标目录。它保留创建时赋予它的权限，而不是您将文件移动到的目标目录的权限。
因此，您希望 tmp 目录具有您想要的权限，基本上是您授予目标目录的权限。然后它将在 setgid 生效的情况下创建，并且移动将保留它们。
IIRC“upload_tmp_dir”在 .htaccess 中不可用，因此如果您无法更改此设置或授予该目录的权限，那么您将需要以其他方式进行操作。
When you upload a file it is created in the dir specified by the PHP's "upload_tmp_dir" setting. Then move_uploaded_file() moves it to your target dir. It maintains the permissions given to it upon creation and not those of the target directory you move the file to.
So you want the tmp dir to have the permissions you want, basically those you've given to your target dir. Then it will be created with the setgid having effect and the move will keep them.
IIRC "upload_tmp_dir" is not available in .htaccess so if you cannot change this setting or the permissions given to the dir then you will need to do it another way.