Why do apache owned files get created by wordpress? Why do apache owned files get created by wordpress? wordpress wordpress

Why do apache owned files get created by wordpress?


When you upload files via the wordpess admin page (like themes) the httpd process running as the apache user is actually creating them on your system--hence why they are owned by the apache user. I suggest this options to work around this:

  1. Add yourself and apache to a new group called 'wordpress'
  2. Use to change group ownership of your wordpress to the new group
  3. Use set the sgid permission bit and the group write permission to all directories in the wordpress docroot.

The setting of the sgid bit will make all files added to a directory be the same group owner.

Assuming you've added yourself and apache to the same group, here's the linux commands to setup the directories to ensure files get created writable to all in the wordpress group:

chown -R :wordpress /path/to/wordpress/docroot/ chmod  -R g+w /path/to/wordpress/docroot/find  /path/to/wordpress/docroot/ -type d -print | while read i; do SAVEIFS=$IFS; IFS=$(echo -en "\n\b");chmod g+s $i; IFS=$SAVEIFS; done

Additional thing that may be needed:

If you see apache creating files with group permissions without write, you may need to change the default umask for the apache user for creation of new files. By default it should be owner and group write allowed, but I know some accounts (like root user) have the default umask set to be group read only.


because apache's worker children run under apache's userid, and a "common user" on a unix system cannot make files be owned by some OTHER user. Only the root account can "give away" ownership.

Why? It'd be trivial for a normal user to make a file owned by root, or owned by another user. If a given system was running with user quotas, this would allow a user to completely subvert the quotas, or deny someone else access by "giving" them a bunch of huge files and exceeding that user's quota.

If you need access to those files, regardless of the unix ownership, you could look into using POSIX acls, which exist above/beyond the unix permissions.