Install umask Apache user

Question

I am setting up a LAMP server and would like to set the Apache umask parameter to 002 so that all files created by Apache set the permission bit for writing to the group (so members of the same group can overwrite files).

Does anyone know how to do this? I know that on Ubuntu you can use the / etc / apache 2 / envvars file to configure umask, but CentOS is running on the server.

Update This question is related to another question that I asked some time ago ( to Linux users and groups for the LAMP server ). If you prefer, please update this other question with what is best set up for a user to use a developer on a server that can edit files created by an Apache user.

Answer 1

Apache inherits its umask from its parent process (i.e. a process starting with Apache); this usually should be a /etc/init.d/ script. So put the umask command in the script.

Answer 2

For CentOS and other Red Hat distributions, add the umask option to / etc / sysconfig / httpd and restart apache.

 [root ~] $ echo "umask 002" >> / etc / sysconfig / httpd
 [root ~] $ service httpd restart

Additional Information: Apache2 umask | MDLog: / sysadmin

For Debian and Ubuntu systems, you will also edit /etc/apache2/envvars .

Answer 3

This was the first result in Google search results for "CentOS 7 apache umask", so I’ll tell you what I need to do to get this working with CentOS 7.

On CentOS 7, the echo "umask 002" >> /etc/sysconfig/httpd method echo "umask 002" >> /etc/sysconfig/httpd did not work for me.

I overwritten the systemd startup file by creating the /etc/systemd/system/httpd.service.d folder, and there I created the umask.conf file with the lines:

 [Service] UMask=0007 

Booted up and it worked for me.

Answer 4

Adding the umask Command in /etc/apache2/envvars for me it does not seem to be a good idea, not only because of the file name (only for the designation of variables), but also based on this comment found in this file:

 # Since there is no sane way to get the parsed apache2 config in scripts, some # settings are defined via environment variables and then used in apache2ctl, # /etc/init.d/apache2, /etc/logrotate.d/apache2, etc. 

This suggests that /etc/apache2/envvars can be obtained by any script that performs Apache-related tasks, and modifying the umask of these (previously unknown) scripts is very dangerous.

On the other hand, if the idea of ​​changing umask for Apache is aimed at resolving permissions of files created with mod_dav , you should consider that the DAV Repository is considered private for Apache and allows other processes to access these files, it can lead to various problems (including corruption) .

Answer 5

On Debian, another place to install umask for Apache is / etc / default / apache 2. Only this line at the end of this file is: umask 0002

Answer 6

Ubuntu has svnwrap tool

• Install sudo apt-get install subversion-tools
• Wrap svn and svnserve with svnwrap:
  sudo ln -s /usr/bin/svnwrap /usr/local/bin/svn
sudo ln -s /usr/bin/svnwrap /usr/local/bin/svnserve

After that, all svn operations using the files: //, svn + ssh: // and http: // protocols will be performed using umask 002

Answer 7

Adding to the answer of Luoti / Spider Man for CentOS7: instead of “downloading” after changing these commands, you can use:

 systemctl daemon-reload service httpd restart 

Answer 8

What you can do is set the sticky bit group bit ( SetGID ) in the directory that CGI works with:

chgrp mygroup dir chmod g+s dir

Make sure that when executing this (apache) user (apache) is in the mygroup group (in /etc/group ), so he will have permissions.

This will make sure that any file created in this directory belongs to the same group as the directory.

This is a safer approach than installing a global umask for EVERY cgi script that apache can run.

(This is how git-http-backend starts from Apache as usual).

Answer 9

Deviating from the Apache Proven and Correct Path is generally not recommended. A lot of time and hard winning experience went into the selection of such things.