Posted by Marc Christiansen on 12/05/07 11:15

Joel Fireman <joelfireman23@nospamhoo.com> wrote:
> On Tue, 04 Dec 2007 23:47:11 +0000, The Natural Philosopher <a@b.c>
> wrote:
>
>>Joel Fireman wrote:
>>> On a Linux server, a web page lets users enter items to an order
>>> sheet. When they finish, (besides the mysql db updates) the order data
>>> is emailed to the user as confirmation, a copy is emailed to the
>>> fulfillment people, and two files are written for pickup by a third
>>> party, in the third party's directory.
>>>
>>> Because the files are owned by apache, the third party cannot delete
>>> them, even when they are chmod'ed to 777. I tried to chown() the files
>>> to the third party's user, but no go.
>>>
>>That is correct behavior - only root or the owner can change file
>>ownerships IIRC.
>>
> He (apache) IS the owner... dat's de point...
>
>>
>>And it looks like changing owners doesn't entirely work when when its
>>your file you are giving away..ho hum.. I remember this from somewhere..
>>
>>I'll try and find out the answer..got me irritated.
>>
>>Ah. You cant delete files if you don't have write access to the
>>*directory* the file is in..?
>
> As mentioned elsewhere, yep, the third party ("orders") had had his
> directory ownership changed to root... somewhere along the line... and
> changing it back to orders now does allow him to delete files after
> downloading them. An' dat's good.
>
>>You need to add your user to the group the directory belongs to and set
>>775 permissions on the DIRECTORY as well, I think.
>
> Setting it to 777 didn't work, so I'm pretty sure 775 won't - nudge,
> nudge... wink, wink... know what I mean?
>
> At this stage, it's mainly for future reference: the functionality is
> there, i.e., the order files are written to a directory owned by
> "orders" and he can ftp 'em down and delete 'em.
>
> ... but I'd still like to figger out why apache can CREATE a file, can
> CHMOD the file, but he can't CHOWN the file and give it to the user
> who actually owns the directory... grrrrr...
>
The linux man page of the chown system call states:
"Only a privileged process (Linux: one with the CAP_CHOWN capability)
may change the owner of a file. The owner of a file may change the
group of the file to any group of which that owner is a member."

So, no luck giving away the file.

Marc

[Back to original message]