Permission issue (umask)

[GlennM]

Directories are created with 0775 permissions (due to umask 002). These permissions on the directories prevent the execution of my PHP files. I get 500 Internal Server error when the directories have 0775.

I've tried to set umask 022 in ~/.bash_profile on my server. This works when connecting via SSH directly (without Deployer).

However, when using Deployer I keep getting umask 0002 instead of umask 0022. Even when defining something like run("source ~/.bash_profile") as a deployer task.

I there something I am missing or are there perhaps better ways to get the permissions setup correctly?
Not sure if it's relevant, but I've symlinked {{deploy_path}}/public_html to {{deploy_path}}/current/src/public

Thanks!

[antonmedv]

due to umask 002

How is that?

Also take a look at this: https://deployer.org/docs/flow.html#deploywritable

[GlennM]

due to umask 002

How is that?

By default, it is set to 0022 (I think suPHP). In /etc/profile, it is set to 002for my deployer user

# By default, we want umask to get set. This sets it for login shell
# Current threshold for system reserved uid/gids is 200
# You could check uidgid reservation validity in
# /usr/share/doc/setup-*/uidgid file
if [ $UID -gt 199 ] && [ "`id -gn`" = "`id -un`" ]; then
    umask 002
else
    umask 022
fi

Also take a look at this: https://deployer.org/docs/flow.html#deploywritable

I've not specified any writable_dirs yet. I don't think that's needed for regular PHP files? This should be an array of writabe directories only I suppose?

[GlennM]

Files also do get 0664 permissions, which make them not work with suPHP. They should be 0644 in order for suPHP to work.

[antonmedv]

I am cleaning up on issues. Fill free to reopen if needed.
Also, we have a new section available: discussions.

[joelpittet]

@GlennM I'm doing similar, without an "interactive shell" you need to set it in .bashrc and I source .bashrc in my .bash_profile so it's the same in both sessions.

[joelpittet]

I'm actually trying to do the opposite of you and loosen up my umask to 0002, but I want deployer to deploy and create files with the more strict umask 0022 or maybe even umask 0027. (Reason for scouring the queue)

[joelpittet]

I ended up leaving my umask to RH deafult 0022 but doing this in my user's .bashrc. Makes sure that my app deploys without giving group write permissions, but when/if the deployment runs PHP commands that write files (artisan/drush/etc) then those will be writable by the web server group as well.

php(){(umask 0002; command php "$@")}```

[yoshi-plur]

It seems that "ssh hostname command~" and ssh login has a different mechanism.
"ssh hostname command~" does not read ~/.profile, so it does not respect umask.
I guess Deployer uses that connection.

I added a line below in /etc/pam.d/sshd

session optional pam_umask.so umask=0027

Now, any ssh connection respect umask and I get the permission as I expect.
This is effective for all ssh connections including SCP, VSCode, and etc.

[flmommens]

Yes, this works and solved my issue (same as GlennM). But this gives the same umask to all users. Isn't there a way to change it just for the user used to deploy? Isn't there a way deployer could execute umask (or any other command for that matter) prior to each task?

[antonmedv]

Actually deployer can execute umask prior all commands. Let’s add a option for this.

[nigoroll]

@antonmedv did you ever do that?

$ git grep -i umask
recipe/magento.php:    run("cd {{release_or_current_path}} && php -r \"require_once 'app/Mage.php'; umask(0); Mage::app()->cleanCache();\"");