Script saving a file / writepermissions

[LocoPollo]

I have made a script and when I do a 'ls -l' then I get this:

-rwxr-xr-x 1 hotguy hotguy 2144 jun 27 19:41 savefile.cgi

The folder I'm trying to save the file in, will only save the file if the folder is set to 777/drwxrwxrwx

So the folder looks like this:

drwxrwxrwx 2 hotguy hotguy 512 jun 27 19:44

...I dont get anything!? the owner is the same, so shouldn't it be able to write without being set to 777?

Anyway, how do I make it work?
I have heard that 777 isn't good - I dont know why, cuz I really got into permissions, and I dont know the difference between owner, group, and all user.


And btw what does that second number mean? how many levels are below this folder?

 

[LocoPollo]

I forgot to say that I have made this script that tries to save files in a folder, the system will only let the script save the files if the permissions for the folder are set to 777, what do I do?? To me, 'drWxr-xr-x' should do, but it doesn't.

*crying like a baby* and asks more questions:

What are permissions and who is the:
owner? - isn't that 'hotguy' in the case above
group? - who is this??
all users? - is the really EVERYONE?? Can anyone mess in a folder with 777 permissions?

if I got a file that says:

-rwxr-xr-x 1 hotguy hotguy 2144 jun 27 19:41 savefile.cgi

isn't 'hotguy' the 'owner'?? and shouldn't 'hotguy's script be able to store files in a folder with these permissions:

drwxrwxrwx 2 hotguy hotguy 512 jun 27 19:44

Anything will help, thanks! )

 

[pcunix]

Although you did not actually say this, I might guess that you are running this from a web server?

If so, it's "apache" (or whatever user apache is running as) that needs write permission to the directory and file (and execute perms for the script).

Tony Lawrence
Linux/Unix/Mac OS X Resources

http://aplawrence.com

 

[LocoPollo]

Ok, thanks!

(And sorry for not being clear, I confused everyone , should I repost a new clear thread?)

Thanks again, but what do I actually do?? Should I let the folder that the script is trying to write to, stay 777 ?

or how do I give apache permission to write to that folder, without letting the whole world being able to do the same?

The best would be if only MY scripts could write and read from that folder.

 

[aardvark92]

You could make apache the owner of the directory (folder).

Try

chown apache <name>

replacing <name> with the name of the directory.

Or you could assign the directory to the apache group:

chgrp apache <name>

Or both.

Then you could assign permissions just for that owner or group, possibly with read-only permissions for all users.

chmod 744 would set the permissions to rwx for the owner and read-only for all other users, whether in the group or not.

Hope this gets you pointed in the right direction.

 

[LocoPollo]

Thanks alot! just tried that but:
(Btw 'apache' didn't work, but I saw that the files that the script saved, was saved as 'www' so I had to use 'www' instead)

$ chown

http://www myfolder

chown: myfolder: Operation not permitted

and

$ chgrp

http://www myfolder

chgrp: you are not member of that group www

...so I think I will try with a line in the script that first chmod the folder to '777' write the file, and the chmod it back to '755'. Its clumbsy and not correct, but the best I can come up with.

 

[LocoPollo]

That didn't work either. I guess I will have to be a gambler and just let the folder stay open with a 777 permission.

Anyway, what is it that people can do (and how?) when a folder has the 777 permissions??

 

[stevexff]

LocoPollo

hotguy? This is just on a box you use at home, right?

 

[aardvark92]

Anyway, what is it that people can do (and how?) when a folder has the 777 permissions??

Permissions correspond to the following numbers:

Read = 4
Write = 2
eXecute = 1

The numeric value represents a combination of these values.

In other words, the possible permissions are:

7 = rwx
6 = rw-
5 = r-x
4 = r--
3 = -wx
2 = -w-
1 = --x
0 = ---

The first digit is the owner's permissions, the second is the group's permissions, and the third is other users' permissions. So, for example, 664 would give read and write privileges to the owner and the group, but read only privileges to others. 751 would give the owner all privileges, the group read and execute, and others execute only.

777 lets anyone who has (or can get) access to that directory read, write, or execute the file.

Also, from the error message you are getting on chmod and chgrp, it appears that you are not the owner of the directory that myfolder is in, or do not have write privileges.

 

[LocoPollo]

stevexff >> hehe, no its not at home. But my real username is just so boring, so why not make a little fun with a silly name when writing the example.

aardvark92 >> thanks alot, but I still dont understand how "someone" can upload and execute a file on the server though. I got the owner, group and user part though, I think:

'Owner' is the profile that uploads the file.

'Group' can be different profiles that are linked together as a group in some apache config file somewhere. Its the group that the owner is member of that you give access to if you give 'group' e.g. a '7'. - If the owner want to be member of more groups, its not possible.

'users' it's the rest of the world??? or who is this?? cuz *I* cant login from other server as 'user', or can I? how do I do? just wanna know, so that I can have that on mind when I try to make something secure.

Thanks!

 

[PaulTEG]

This might be of some benefit, have you sudo access?
--Paul

cigless ...

 

[aardvark92]

'users' it's the rest of the world???

It's anyone who has access to the server. For example, if your ISP gives shell access to its customers, they could cd to your directory and do whatever they have permission to do. Or, if a malicious user steals a password and gets access to the server...

Essentially, anyone who can get access to the machine will at least have 'users' permissions.

 

[LocoPollo]

Thanks alot!

So, what I have to be scared of when I write 777 is that the other 'users' on the server are trying to hack my folder.

Or that some 'user' has made a weak script that makes their 'user' login into my folder.

------

But wait a minute! If the 'owner' of files stored by a perlscript is 'apache', then any of the other 'users' can make a script that does things to my folders anyway, since their script does things as 'apache' too!? Half my folders/files were made my perlscripts and therefore owned my 'apache'

Owell....

 

[LocoPollo]

Thanks got the last message while writing the other one.

So, it sounds like I'm repeating myself.

Thanks everyone! I'm still confused, on a higher level though.