Олег
- 9 апреля 2024
Настройка правильных прав доступа к файлам и папкам Drupal — залог хорошего сна администратора сайта. Сегодня пойдёт речь про права доступа в Linux и про настройку доступа из консоли, потребуется доступ по SSH.
Когда нам может понадобиться настройка прав доступа?
- Когда мы где-то накосячили, поменяли права
- Когда мы переносим сайт из Windows в Linux
- Когда мы вручную добавляем какие-то модули
- Когда кто-то до нас администрировал сайт
- Когда мы загружаем сайт по FTP или ещё каким-то способом
- После восстановления сайта
- И в других случаях, о которых я не подумал
По настройкам прав доступа имеются рекомендации:
Владение:
- drupal_admin:www-data — Core modules/themes files and directories
- site_admin:www-data — Hosted sites modules/themes/files files and directories
Права:
- rwxr-x--- — Core modules/themes directories
- rw-r----- — Core modules/themes files
- rwxr-x--- — Hosted sites modules/themes directories
- rw-r----- — Hosted sites modules/themes files
- rwxrwx--- — Hosted sites "files" directory
- rw-rw---- — Hosted sites files under "files" directories
- rwxrwx--- — Hosted sites subdirectories under "files" directories
Чтобы нам вручную не возиться, имеются готовые скрипты:
https://github.com/Metadrop/drupal-fix-permissions-script/
Здесь имеется сам скрипт по настройке прав, и скрипты автоматизации. На всякий случай скопирую себе основной скрипт.
#!/bin/bash
# This script sets the right permissions and ownership on a Drupal installation.
# Loosely based on https://www.drupal.org/node/244924
#
# Copyright (C) 2023 Ricardo Sanz Ante
# This is program is licensed the GPL 3.0. See https://www.gnu.org/licenses/gpl-3.0.html
# This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you
# are welcome to redistribute it under certain conditions;
# Script usage help.
function usage() {
cat <<HELP
SYNOPSIS
`basename "$0"` [OPTION]...
DESCRIPTION
This script fixes permissions on a Drupal installation. See
https://www.drupal.org/node/244924
There are two kinds of files and directories: code and content.
Code are the Drupal codebase, contrib code and configuration files.
Those should be writable by the deploy user (the user that handles the
Drupal files) and readable by the webserver. This allows the deploy user to
modify the code if needed, but prohibits the webserver (the HTTPD process)
to modify them, increasing security.
Content files and directories are those that hold files used generally as
content: mainly uploaded files by users and generated files by the server.
These should be readable and writable by both the deploy user (so they can
manage them if needed) and the webserver (so the webserver can manage them
as well).
To allow this, code is owned by the deploy user and belongs to the group
of the webserver process. The permissions set allows owner to write those
files and folder but group members can only read them.
Content files and directories have the same ownership scheme (they are
owned by the deploy user and belong to the webserver's group) but
permissions allow both editing and reading.
-u, --drupal_user=<user>: User that manages the Drupal code, the deploy
user. Mandatory.
-g, --httpd_group=<group>: Web server process group. Files will be assigned
to this group. Defaults to 'www-data'.
-p, --drupal_path=<path>: Path to the Drupal root directory. Defaults to the
current directory ('.').
-f, --files-path=<path>: Additional content files directories. Use as much
times as you need. Relative paths are relative to the Drupal path. This
is useful when files directory is not under sites directory, for example
outside the Drupal root.
-s, --setgid: Enable setgid on content files directories. When enabled, all
files and directories created under a setgid directory will be assigned
to the group of the setgid directory regardless of the process that
created the file. This is useful if a user different from the HTTPD user
creates a file inside a content directory. With setgid, the file will
be part of the HTTPD group, allowing the HTTPD process to edit or remove
the file if needed. Otherwise, the HTTPD process lacks the permissions
to do so.
-n, --dry-run: Perform no action but display information about what would be
done. Use twice for more information.
-h, --help: Display this help message.
EXAMPLES
`basename "$0"` -u=deploy
Fix permissions using 'deploy' as owner, and default values for group
owner and Drupal Path.
`basename "$0"` -u=deploy -g=www.data
Fix permissions using 'deploy' as owner and 'www-data' as group owner. Use
the default path to Drupal.
`basename "$0"` -u=deploy -g=www.data -p=/var/vhosts/drupal/web
Fix permissions using 'deploy' as owner and 'www-data' as group owner.
Finds the Drupal in '/var/vhosts/drupal/web'.
`basename "$0"` -u=deploy -s
Fix permissions using 'deploy' as owner, and defaults value for group
owner and Drupal Path. Sets the setgid bit to the content files
directories.
`basename "$0"` -u=deploy -f=../private
Fix permissions using 'deploy' as owner, and defaults value for group
owner and Drupal Path. Process an additional content directory at
'../private', relative to the Drupal path.
`basename "$0"` -u=deploy -n -n
Display the list of files and directories that would be fixed, using
'deploy' as owner, and default values for group owner and Drupal Path.
HELP
}
# Determines if current user is the root user.
#
# Returns:
# 0 if it is the root user.
# 1 if it is not the root user.
function is_root_user() {
[ $(id -u) == 0 ]
}
# Determines if a user exists in the system.
#
# Returns:
# 0 if it is the root user.
# 1 if it is not the root user.
function is_valid_user() {
[ ! -z "$1" ] && [[ $(id -un "$1" 2> /dev/null) == "$1" ]]
}
# Determines if a path is a Drupal root directory.
#
# The function checks that the path exists, it has a "sites" directory and tries
# to find the ssytem.module file. It detects Drupal 7/8/9/10.
#
# Params:
# $1 Path to check.
#
# Returns:
# 0 if it is a Drupal root directory.
# 1 if it is not a Drupal root directory.
is_drupal_root() {
[ ! -z "$1" ] && [ -d "$1" ] && [ -d "$1/sites" ] && ([ -f "$1/core/modules/system/system.module" ] || [ -f "$1/modules/system/system.module" ])
}
# Sets the right owners for a given directory.
#
# Find any file or folder that is not owned by the drupal user or its group is
# not the web server group and fixes the ownership.
#
# Params:
# $1 Path to the directory to process.
#
# Globals:
# drupal_user: user to own the files and directories.
# httpd_group: group to own the files and directories.
function fix_onwership() {
case $simulate in
0)
# Real action.
find "$1" $detected_vendor_path \( ! -user $drupal_user -o ! -group $httpd_group \) \( -type f -o -type d \) -print0 | xargs -r -0 -L20 chown $drupal_user:$httpd_group
;;
1)
# Simulate.
printf "\n Items with wrong ownership: "
find "$1" $detected_vendor_path \( ! -user $drupal_user -o ! -group $httpd_group \) \( -type f -o -type d \) -print | wc -l
;;
2)
# Simulate verbosely.
printf "\n Files and directories that would have their ownership fixed: "
# Use a variable to indent output.
items=$(find "$1" $detected_vendor_path \( ! -user $drupal_user -o ! -group $httpd_group \) \( -type f -o -type d \) -print)
items=${items:-None}
printf "\n ${items//$'\n'/$'\n' }\n"
;;
esac
}
# Helper function to set the permissions on code files and folders.
#
# This is an internal function.
#
# Params:
# $1 Path to the directory to process.
# $2 Type of element to process. f for files, d for directories.
# $3 Permissions wanted compatible with chmod . Exmaple: u=rwx,g=rwxs,o=
function fix_code_permission_helper() {
case $simulate in
0)
# Real action.
find "$1" \( -path "$1"/sites/\*/$file_folder_name -prune \) -o \( -path "$1"/sites/\*/$private_folder_name -prune \) -o \( -type $2 ! -perm $3 -print0 \) | xargs -r -0 -L4 chmod $3
;;
1)
# Simulate.
num=$(find "$1" \( -path "$1"/sites/\*/$file_folder_name -prune \) -o \( -path "$1"/sites/\*/$private_folder_name -prune \) -o \( -type $2 ! -perm $3 -print \) | wc -l)
printf "\n Code items with wrong permissions: $num"
;;
2)
# Simulate verbosely.
printf "\n Code files and directories that would have their permissions fixed: "
# Use a variable to indent output.
items=$(find "$1" \( -path "$1"/sites/\*/$file_folder_name -prune \) -o \( -path "$1"/sites/\*/$private_folder_name -prune \) -o \( -type $2 ! -perm $3 -print \))
items=${items:-None}
printf "\n ${items//$'\n'/$'\n' }\n"
;;
esac
}
# Helper function to set the permissions on content files and folders.
#
# This is an internal function.
#
# Params:
# $1 Path to the directory to process.
# $2 Type of element to process. f for files, d for directories.
# $3 Permissions wanted compatible with chmod . Exmaple: u=rwx,g=rwxs,o=
function fix_content_permission_helper() {
case $simulate in
0)
# Real action.
find "$1" -type $2 ! -perm $3 -print0 | xargs -r -0 -L20 chmod $3
;;
1)
# Simulate.
num=$(find "$1" -type $2 ! -perm $3 -print | wc -l)
printf "\n Content items with wrong permissions: $num"
;;
2)
# Simulate verbosely.
printf "\n Content files and directories that would have their permissions fixed: "
# Use a variable to indent output.
items=$(find "$1" -type $2 ! -perm $3 -print)
items=${items:-None}
printf "\n ${items//$'\n'/$'\n' }\n"
;;
esac
}
# Sets the permissions of a code path.
#
# Params:
# $1 Path to process.
#
# Globals:
# code_dir_perms: permissions scheme to use for code directories.
# code_file_perms permissions scheme to use for code files.
function fix_code_permissions() {
name=$(basename "$1")
printf "\n Setting permissions on code directories to $code_dir_perms under '$name'"
fix_code_permission_helper "$1" d "$code_dir_perms"
printf "\n Setting permissions on code files to $code_file_perms under '$name'"
fix_code_permission_helper "$1" f "$code_file_perms"
if [ ! -z "$detected_vendor_path" ]
then
printf "\n Setting permissions on vendor code directories to $code_dir_perms under '$detected_vendor_path'"
fix_code_permission_helper "$detected_vendor_path" d "$code_dir_perms"
printf "\n Removing all permissions on vendor code files to other users ($vendor_code_file_perms) under '$detected_vendor_path'"
fix_code_permission_helper "$detected_vendor_path" f "$vendor_code_file_perms"
fi
}
# Sets the permissions of a content path.
#
# Params:
# $1 Path to process.
#
# Globals:
# content_dir_perms: permissions scheme to use for content directories.
# content_file_perms permissions scheme to use for content files.
function fix_content_permissions() {
name=$(basename "$1")
printf "\n Setting permissions on content directories to $content_dir_perms under '$name'"
fix_content_permission_helper "$1" d "$content_dir_perms"
printf "\n Setting permissions on content files to $content_file_perms under '$name'"
fix_content_permission_helper "$1" f "$content_file_perms"
}
# Main code
###########
#
printf "Script to fix permissions in a Drupal installation"
# Default values.
DEFAULT_DRUPAL_PATH=.
DEFAULT_HTTPD_GROPUP="www-data"
# Initialize some values.
group_executable_mode=x
additional_files_paths=""
file_folder_name='files'
private_folder_name='private'
simulate=0
# Parse Command Line Arguments
while [ "$#" -gt 0 ]; do
case "$1" in
--drupal_path=* | -p=*)
drupal_path="${1#*=}"
;;
--drupal_user=* | -u=*)
drupal_user="${1#*=}"
;;
--httpd_group=* | -g=*)
httpd_group="${1#*=}"
;;
--files-path=* | -f=*)
# Add a new line if there is any previous element.
if [ ! -z "$additional_files_paths" ]
then
additional_files_paths+='\n'
fi
# Add path to the path list.
additional_files_paths=$(printf "${additional_files_paths}${1#*=}")
;;
--setgid | -s)
group_executable_mode=xs
;;
--dry-run | -n)
simulate=$((simulate + 1))
;;
--help | -h)
usage
exit 0
;;
*)
printf "\nError: Invalid parameter '$1'\n"
exit 1
esac
shift
done
# Initialize undefined values with default values.
if [ -z $drupal_path ]
then
drupal_path=$DEFAULT_DRUPAL_PATH
printf "\nUsing default Drupal path '$DEFAULT_DRUPAL_PATH'"
fi
if [ -z $httpd_group ]
then
httpd_group=$DEFAULT_HTTPD_GROPUP
printf "\nUsing default HTTPD group '$DEFAULT_HTTPD_GROPUP'"
fi
# Calculate permissions by object type (directory or file) and function (code or
# content files).
code_dir_perms='u=rwx,g=rx,o='
code_file_perms='u=rw,g=r,o='
vendor_code_file_perms='o='
content_dir_perms="u=rwx,g=rw${group_executable_mode},o="
content_file_perms='ug=rw,o='
# Go to the right place (this a kind of initialization).
cd $drupal_path
complete_drupal_path=$(pwd)
# Check if there's a vendor folder in the upper folder.
[ -d "../vendor" ] && [ -f "../composer.json" ] && detected_vendor_path="../vendor"
# Show current configuration.
#############################
printf "\nRunning configuration:
Path: $complete_drupal_path
Owner user: $drupal_user
Owner group: $httpd_group
Code dirs perms: $code_dir_perms
Code files perms: $code_file_perms
Separated vendor folder detected: ${detected_vendor_path:-"No"}
Content dirs perms: $content_dir_perms
Content files perms: $content_file_perms
File folder name: $file_folder_name
Private files folder name: $private_folder_name
"
if [ ! -z "${additional_files_paths}" ]
then
printf "Additional content directories to process:\n${additional_files_paths}"
fi
# Sanity checks.
################
#
is_root_user
if [ $? -ne 0 ]
then
printf "\nError: you must run this script as the root user\n"
exit 1
fi
is_drupal_root $drupal_path
if [ $? -ne 0 ]
then
printf "\nError: provided path '$drupal_path' is not the root directory of a Drupal installation\n"
exit 1
fi
if [ -z $drupal_user ]
then
printf "\nError: no user provided\n"
exit 1
fi
is_valid_user $drupal_user
if [ $? -ne 0 ]
then
printf "\nError: provided user '$drupal_user' is not a valid user\n"
exit 1
fi
# Do the job
############
#
printf "\n\nAll checks passed, go!"
printf "\nProcessing Drupal installed on '$complete_drupal_path'"
# First, fix ownership.
printf "\nFixing ownership of files and directories"
fix_onwership "$complete_drupal_path"
echo "$additional_files_paths"| while read path; do
[ -d "$path" ] && fix_onwership "$path"
done
# Second, fix permissions on code.
printf "\nFixing permissions on code files and directories"
fix_code_permissions "$complete_drupal_path"
# Third, fix permissions on content.
printf "\nFixing permissions on content files and directories under 'sites' folder"
find "$complete_drupal_path/sites/" -maxdepth 1 -mindepth 1 -type d| while read site_folder
do
printf "\n Checking folder "
printf $(basename "$site_folder")
[ -d "$site_folder/$file_folder_name" ] && fix_content_permissions "$site_folder/$file_folder_name"
[ -d "$site_folder/$private_folder_name" ] && fix_content_permissions "$site_folder/$private_folder_name"
done
[ -z "$additional_files_paths" ] && printf "\nProcessing additional content folders"
echo "$additional_files_paths"| while read path; do
[ -d "$path" ] && fix_content_permissions "$path"
done
printf "\n\nPermissions and ownership fixed!\n"
Помощь:
drupal_fix_permissions.sh -h
Пример:
drupal_fix_permissions.sh -u=www-data -g=www-data -p=/var/www/html/drupal/