PHP DB - LAMP uploaded file permissions preventing db upload

Author

LAMP uploaded file permissions preventing db upload

Will Cordle

2004-09-26, 3:55 am

On my LAMP system, I am using the http post method for uploading files from the browser into the
/tmp directory. Then using the MySQL "load file" command to load that file into the database.
Well at least I am trying to.

The upload to the /tmp directory is working fine, but due to file permissions, the load into the
db is failing.

Apache/PHP is running as nobody:nobody (I have tried different groups with no luck)
MySQL is running as mysql:mysql

permissions on /tmp are currently:
drwxrwxrwx 12 root root 4096 Sep 25 22:17 tmp

permissions on a file that has been uploaded to /tmp are currently:
-rw------- 1 nobody nobody 255775 Sep 25 22:17 test.csv

If I change the permissions on the file to world-readable the db load works as expected. Any
ideas on how to get Apache/PHP to write the file to /tmp as world-readable would be greatly
appreciated. Of course if I should be taking a different approach, I would be welcome to
recommendations there as well.

Thanks
Will

Neil Smith [Mvp

2004-09-27, 3:57 pm

I'm not sure what the security implications would be, but if you added
MySQL also to the `nobody` group, it should be able to read the file from
that directory. /tmp is generally world-readable, so it's just the file
permissions that are causing the problem, as you say.

Previously I've used PHP to do this, just issuing chmod(0755); on the
/tmp/file_name within PHP rather than running exec(chmod blah)

But generally, I wouldn't expect allowing MySQL to access 'nobody' files to
be a problem - the other way round (allowing it to open User or Root-owned
files) would open a huge security hole, of course.

HTH
Cheers - Neil

At 11:45 26/09/2004 +0000, you wrote:
>Message-ID: <20040926024241.29619.qmail@web41129.mail.yahoo.com>
>Date: Sat, 25 Sep 2004 19:42:41 -0700 (PDT)
>From: Will Cordle <wcordle@yahoo.com>
>To: php-db@lists.php.net
>MIME-Version: 1.0
>Content-Type: text/plain; charset=us-ascii
>Subject: LAMP uploaded file permissions preventing db upload
>
>On my LAMP system, I am using the http post method for uploading files
>from the browser into the
>/tmp directory. Then using the MySQL "load file" command to load that
>file into the database.
>Well at least I am trying to.
>
>The upload to the /tmp directory is working fine, but due to file
>permissions, the load into the
>db is failing.
>
>Apache/PHP is running as nobody:nobody (I have tried different groups with
>no luck)
>MySQL is running as mysql:mysql
>
>permissions on /tmp are currently:
>drwxrwxrwx 12 root root 4096 Sep 25 22:17 tmp
>
>permissions on a file that has been uploaded to /tmp are currently:
>-rw------- 1 nobody nobody 255775 Sep 25 22:17 test.csv
>
>If I change the permissions on the file to world-readable the db load
>works as expected. Any
>ideas on how to get Apache/PHP to write the file to /tmp as world-readable
>would be greatly
>appreciated. Of course if I should be taking a different approach, I
>would be welcome to
>recommendations there as well.
>
>Thanks
>Will

========================================
================
CaptionKit http://www.captionkit.com : Production tools
for accessible subtitled internet media, transcripts
and searchable video. Supports Real Player, Quicktime
and Windows Media Player.

VideoChat with friends online, get Freshly Toasted every
day at http://www.fresh-toast.net : NetMeeting solutions
for a connected world.

Will Cordle

2004-09-27, 3:57 pm

Neil -
Being new to this, it never occurred to me that I could acutally chmod the file through PHP. Now
after I move the file, I chmod it, and everything works just fine. I really appreciate the help.

Thanks
Will

--- "Neil Smith [MVP, Digital media]" <php@comatose.freeserve.co.uk> wrote:

> I'm not sure what the security implications would be, but if you added
> MySQL also to the `nobody` group, it should be able to read the file from
> that directory. /tmp is generally world-readable, so it's just the file
> permissions that are causing the problem, as you say.
>
> Previously I've used PHP to do this, just issuing chmod(0755); on the
> /tmp/file_name within PHP rather than running exec(chmod blah)
>
> But generally, I wouldn't expect allowing MySQL to access 'nobody' files to
> be a problem - the other way round (allowing it to open User or Root-owned
> files) would open a huge security hole, of course.
>
> HTH
> Cheers - Neil
>
> At 11:45 26/09/2004 +0000, you wrote:
>
>
> ========================================
================
> CaptionKit http://www.captionkit.com : Production tools
> for accessible subtitled internet media, transcripts
> and searchable video. Supports Real Player, Quicktime
> and Windows Media Player.
>
> VideoChat with friends online, get Freshly Toasted every
> day at http://www.fresh-toast.net : NetMeeting solutions
> for a connected world.
>
>
>
>

Sponsored Links