Cron job and folders permissions - permission denied

Question

I have a folder above the webroot that is used to temporarily store user files generated by a php web application. The files may, for example, be PDF's that are going to be attached to emails.

The folder permissions are set to rwxr-xr-x (0755). When executing a procedure from the web application, the files get written to this folder without any issues.

I have now also set up a cron job that calls the php script to execute that exact same procedure as above. However, the PDF cannot be saved into the above folder due to failed permissions - the cron job reports back a permission denied error.

I have tried setting the folder permissions to 0775 and still get a permission denied. However, when the permissions are 0777, then the cron job then works fine.

This seems very strange to me - why does the cron get a permission denied at 0755 but it works fine through the web app?

Answer 1

The probable answer is that the cron job executes under your user - and the directory is owned by apache (or www-data or nobody or whatever user your web server runs as).

To get it to work, you could set up the cron job to run as the web server user. Something like this:

su -l www-data -c 'crontab -e'

Alternatively, you could change the permissions to 775 (read-write-execute for the owner and group, and read-execute for others) and set the group ownership of the folder to the user running the cron job.

However, you have to make sure that if you're deleting something or descending into folder which is created by apache, you could still run into problems (apache would create a file which it itself owns, and your user cannot delete it then, regardless of the directory permissions.

You could also look at some stuff like suphp or whatever is up to date - where the web server processes are ran under your username, depending on your system architecture.

Answer 2

It depends on which user you have defined the cronjob.

If you're root (not recommended) it should work. If you're the web-user (e.g. www-data on ubuntu) it should work as well.

sudo su - www-data
crontab -e