Posted by Joel Fireman on 12/05/07 05:20

On Tue, 04 Dec 2007 23:47:11 +0000, The Natural Philosopher <a@b.c>
wrote:

>Joel Fireman wrote:
>> On a Linux server, a web page lets users enter items to an order
>> sheet. When they finish, (besides the mysql db updates) the order data
>> is emailed to the user as confirmation, a copy is emailed to the
>> fulfillment people, and two files are written for pickup by a third
>> party, in the third party's directory.
>>
>> Because the files are owned by apache, the third party cannot delete
>> them, even when they are chmod'ed to 777. I tried to chown() the files
>> to the third party's user, but no go.
>>
>That is correct behavior - only root or the owner can change file
>ownerships IIRC.
>
He (apache) IS the owner... dat's de point...

>
>And it looks like changing owners doesn't entirely work when when its
>your file you are giving away..ho hum.. I remember this from somewhere..
>
>I'll try and find out the answer..got me irritated.
>
>Ah. You cant delete files if you don't have write access to the
>*directory* the file is in..?

As mentioned elsewhere, yep, the third party ("orders") had had his
directory ownership changed to root... somewhere along the line... and
changing it back to orders now does allow him to delete files after
downloading them. An' dat's good.

>You need to add your user to the group the directory belongs to and set
>775 permissions on the DIRECTORY as well, I think.

Setting it to 777 didn't work, so I'm pretty sure 775 won't - nudge,
nudge... wink, wink... know what I mean?

At this stage, it's mainly for future reference: the functionality is
there, i.e., the order files are written to a directory owned by
"orders" and he can ftp 'em down and delete 'em.

.... but I'd still like to figger out why apache can CREATE a file, can
CHMOD the file, but he can't CHOWN the file and give it to the user
who actually owns the directory... grrrrr...

[Back to original message]