Allow Apache/PHP a read/write access to a mounted directory

5
votes

We have websites running on a linux server with apache httpd and php. On that server a certain directory from a windows server is mounted as let's say /mnt/some_directory/. I can browse this directory with both WinSCP or SSH, using my own user account.

I can also perform the following in SSH:

php -r "print_r(file_get_contents('/mnt/some_directory/file_name.txt'));"

and see contents of that file.

We need to read a file and parse from that directory in order to import it in the database that is used by the website. But when an fopen or a file_get_contents on the website we get a permission denied error.

I have limited access to the web server (and limited knowledge of *nix and apache configuration), but the administrator that is supposed to resolve this apparently is also lacking this knowledge and I need to have this task resolved,that's why I am asking here.

What the admin did was to set the group and ownership of the mounted directory to"apache", which is the user the httpd process is running as. But that didn't help.

As far as I know access to files outside of the webroot is disallowed by default. Would it be sufficient to set a DIRECTORY directive in httpd.conf for /mnt/some_directory/? Or is there anything else that has to be done?

3
phpapachemount
Can you link the directory like /var/www/linkedtomntsomething ? Don't really know if it works (can't test right now) - Filipe YaBa Polido
It may be a Selinux permission issue. - Sergiu Paraschiv
Thanks. According to ps -ZC httpd the httpd processes are run by an "unconfined_u", so I guess the Selinux user mappings map the user "apache" to "unconfined_u". Would it be save to change this mapping for apache? - Christian Kirchhoff

3 Answers

8
votes

our team had the same issue, my team-mate was able to resolve this by adding context to mount options.

we are using the following format for mounting windows shared folder to linux that apache will be able to access:

mount -v -t cifs <//$hostname/$(windows shared dir)> <mount directory> -o username="<username>",password=<password>,domain=<domain name>,iocharset=utf8,file_mode=0777,dir_mode=0777,context="system_u:object_r:httpd_sys_content_t:s0"

For example:

mount -v -t cifs //192.168.1.19/sample_dir /mnt/mount_dir -o username="admin",password=adminpwd,domain=MIINTER,iocharset=utf8,file_mode=0777,dir_mode=0777,context="system_u:object_r:httpd_sys_content_t:s0"
1
votes

Link the mounted directory to your www root dir and name the link "share"

ln -s /mnt/some_directory /path/to/your/www/root/directory/share

than try reading the file

php -r "print_r(file_get_contents('/path/to/your/www/root/directory/share/file_name.txt'));"

...or you can allow (if you have enough privileges to edit the webserver's configuration)

<Directory /mnt/somedirectory >
    Allow from All
</Directory>
0
votes

i have seen the same problem with a cifs mount linux/unix apache that user can have access to the mounted volume, but not apache.

see also this: EnableSendfile off

but when turned off, apache may work slowly, in .htaccess, only for the cifs mount path, it should work ... .

http://httpd.apache.org/docs/current/en/mod/core.html

best regards L.Tomas