Настройка правильных прав доступа к файлам и папкам Drupal — залог хорошего сна администратора сайта. Сегодня пойдёт речь про права доступа в Linux и про настройку доступа из консоли, потребуется доступ по SSH.
Когда нам может понадобиться настройка прав доступа?
- Когда мы где-то накосячили, поменяли права
- Когда мы переносим сайт из Windows в Linux
- Когда мы вручную добавляем какие-то модули
- Когда кто-то до нас администрировал сайт
- Когда мы загружаем сайт по FTP или ещё каким-то способом
- После восстановления сайта
- И в других случаях, о которых я не подумал
По настройкам прав доступа имеются рекомендации:
Владение:
- drupal_admin:www-data — Core modules/themes files and directories
- site_admin:www-data — Hosted sites modules/themes/files files and directories
Права:
- rwxr-x--- — Core modules/themes directories
- rw-r----- — Core modules/themes files
- rwxr-x--- — Hosted sites modules/themes directories
- rw-r----- — Hosted sites modules/themes files
- rwxrwx--- — Hosted sites "files" directory
- rw-rw---- — Hosted sites files under "files" directories
- rwxrwx--- — Hosted sites subdirectories under "files" directories
Чтобы нам вручную не возиться, имеются готовые скрипты:
https://github.com/Metadrop/drupal-fix-permissions-script/
Здесь имеется сам скрипт по настройке прав, и скрипты автоматизации. На всякий случай скопирую себе основной скрипт.
-
drupal_fix_permissions.sh
#!/bin/bash # This script sets the right permissions and ownership on a Drupal installation. # Loosely based on https://www.drupal.org/node/244924 # # Copyright (C) 2023 Ricardo Sanz Ante # This is program is licensed the GPL 3.0. See https://www.gnu.org/licenses/gpl-3.0.html # This program comes with ABSOLUTELY NO WARRANTY. This is free software, and you # are welcome to redistribute it under certain conditions; # Script usage help. function usage() { cat <<HELP SYNOPSIS `basename "$0"` [OPTION]... DESCRIPTION This script fixes permissions on a Drupal installation. See https://www.drupal.org/node/244924 There are two kinds of files and directories: code and content. Code are the Drupal codebase, contrib code and configuration files. Those should be writable by the deploy user (the user that handles the Drupal files) and readable by the webserver. This allows the deploy user to modify the code if needed, but prohibits the webserver (the HTTPD process) to modify them, increasing security. Content files and directories are those that hold files used generally as content: mainly uploaded files by users and generated files by the server. These should be readable and writable by both the deploy user (so they can manage them if needed) and the webserver (so the webserver can manage them as well). To allow this, code is owned by the deploy user and belongs to the group of the webserver process. The permissions set allows owner to write those files and folder but group members can only read them. Content files and directories have the same ownership scheme (they are owned by the deploy user and belong to the webserver's group) but permissions allow both editing and reading. -u, --drupal_user=<user>: User that manages the Drupal code, the deploy user. Mandatory. -g, --httpd_group=<group>: Web server process group. Files will be assigned to this group. Defaults to 'www-data'. -p, --drupal_path=<path>: Path to the Drupal root directory. Defaults to the current directory ('.'). -f, --files-path=<path>: Additional content files directories. Use as much times as you need. Relative paths are relative to the Drupal path. This is useful when files directory is not under sites directory, for example outside the Drupal root. -s, --setgid: Enable setgid on content files directories. When enabled, all files and directories created under a setgid directory will be assigned to the group of the setgid directory regardless of the process that created the file. This is useful if a user different from the HTTPD user creates a file inside a content directory. With setgid, the file will be part of the HTTPD group, allowing the HTTPD process to edit or remove the file if needed. Otherwise, the HTTPD process lacks the permissions to do so. -n, --dry-run: Perform no action but display information about what would be done. Use twice for more information. -h, --help: Display this help message. EXAMPLES `basename "$0"` -u=deploy Fix permissions using 'deploy' as owner, and default values for group owner and Drupal Path. `basename "$0"` -u=deploy -g=www.data Fix permissions using 'deploy' as owner and 'www-data' as group owner. Use the default path to Drupal. `basename "$0"` -u=deploy -g=www.data -p=/var/vhosts/drupal/web Fix permissions using 'deploy' as owner and 'www-data' as group owner. Finds the Drupal in '/var/vhosts/drupal/web'. `basename "$0"` -u=deploy -s Fix permissions using 'deploy' as owner, and defaults value for group owner and Drupal Path. Sets the setgid bit to the content files directories. `basename "$0"` -u=deploy -f=../private Fix permissions using 'deploy' as owner, and defaults value for group owner and Drupal Path. Process an additional content directory at '../private', relative to the Drupal path. `basename "$0"` -u=deploy -n -n Display the list of files and directories that would be fixed, using 'deploy' as owner, and default values for group owner and Drupal Path. HELP } # Determines if current user is the root user. # # Returns: # 0 if it is the root user. # 1 if it is not the root user. function is_root_user() { [ $(id -u) == 0 ] } # Determines if a user exists in the system. # # Returns: # 0 if it is the root user. # 1 if it is not the root user. function is_valid_user() { [ ! -z "$1" ] && [[ $(id -un "$1" 2> /dev/null) == "$1" ]] } # Determines if a path is a Drupal root directory. # # The function checks that the path exists, it has a "sites" directory and tries # to find the ssytem.module file. It detects Drupal 7/8/9/10. # # Params: # $1 Path to check. # # Returns: # 0 if it is a Drupal root directory. # 1 if it is not a Drupal root directory. is_drupal_root() { [ ! -z "$1" ] && [ -d "$1" ] && [ -d "$1/sites" ] && ([ -f "$1/core/modules/system/system.module" ] || [ -f "$1/modules/system/system.module" ]) } # Sets the right owners for a given directory. # # Find any file or folder that is not owned by the drupal user or its group is # not the web server group and fixes the ownership. # # Params: # $1 Path to the directory to process. # # Globals: # drupal_user: user to own the files and directories. # httpd_group: group to own the files and directories. function fix_onwership() { case $simulate in 0) # Real action. find "$1" $detected_vendor_path \( ! -user $drupal_user -o ! -group $httpd_group \) \( -type f -o -type d \) -print0 | xargs -r -0 -L20 chown $drupal_user:$httpd_group ;; 1) # Simulate. printf "\n Items with wrong ownership: " find "$1" $detected_vendor_path \( ! -user $drupal_user -o ! -group $httpd_group \) \( -type f -o -type d \) -print | wc -l ;; 2) # Simulate verbosely. printf "\n Files and directories that would have their ownership fixed: " # Use a variable to indent output. items=$(find "$1" $detected_vendor_path \( ! -user $drupal_user -o ! -group $httpd_group \) \( -type f -o -type d \) -print) items=${items:-None} printf "\n ${items//$'\n'/$'\n' }\n" ;; esac } # Helper function to set the permissions on code files and folders. # # This is an internal function. # # Params: # $1 Path to the directory to process. # $2 Type of element to process. f for files, d for directories. # $3 Permissions wanted compatible with chmod . Exmaple: u=rwx,g=rwxs,o= function fix_code_permission_helper() { case $simulate in 0) # Real action. find "$1" \( -path "$1"/sites/\*/$file_folder_name -prune \) -o \( -path "$1"/sites/\*/$private_folder_name -prune \) -o \( -type $2 ! -perm $3 -print0 \) | xargs -r -0 -L4 chmod $3 ;; 1) # Simulate. num=$(find "$1" \( -path "$1"/sites/\*/$file_folder_name -prune \) -o \( -path "$1"/sites/\*/$private_folder_name -prune \) -o \( -type $2 ! -perm $3 -print \) | wc -l) printf "\n Code items with wrong permissions: $num" ;; 2) # Simulate verbosely. printf "\n Code files and directories that would have their permissions fixed: " # Use a variable to indent output. items=$(find "$1" \( -path "$1"/sites/\*/$file_folder_name -prune \) -o \( -path "$1"/sites/\*/$private_folder_name -prune \) -o \( -type $2 ! -perm $3 -print \)) items=${items:-None} printf "\n ${items//$'\n'/$'\n' }\n" ;; esac } # Helper function to set the permissions on content files and folders. # # This is an internal function. # # Params: # $1 Path to the directory to process. # $2 Type of element to process. f for files, d for directories. # $3 Permissions wanted compatible with chmod . Exmaple: u=rwx,g=rwxs,o= function fix_content_permission_helper() { case $simulate in 0) # Real action. find "$1" -type $2 ! -perm $3 -print0 | xargs -r -0 -L20 chmod $3 ;; 1) # Simulate. num=$(find "$1" -type $2 ! -perm $3 -print | wc -l) printf "\n Content items with wrong permissions: $num" ;; 2) # Simulate verbosely. printf "\n Content files and directories that would have their permissions fixed: " # Use a variable to indent output. items=$(find "$1" -type $2 ! -perm $3 -print) items=${items:-None} printf "\n ${items//$'\n'/$'\n' }\n" ;; esac } # Sets the permissions of a code path. # # Params: # $1 Path to process. # # Globals: # code_dir_perms: permissions scheme to use for code directories. # code_file_perms permissions scheme to use for code files. function fix_code_permissions() { name=$(basename "$1") printf "\n Setting permissions on code directories to $code_dir_perms under '$name'" fix_code_permission_helper "$1" d "$code_dir_perms" printf "\n Setting permissions on code files to $code_file_perms under '$name'" fix_code_permission_helper "$1" f "$code_file_perms" if [ ! -z "$detected_vendor_path" ] then printf "\n Setting permissions on vendor code directories to $code_dir_perms under '$detected_vendor_path'" fix_code_permission_helper "$detected_vendor_path" d "$code_dir_perms" printf "\n Removing all permissions on vendor code files to other users ($vendor_code_file_perms) under '$detected_vendor_path'" fix_code_permission_helper "$detected_vendor_path" f "$vendor_code_file_perms" fi } # Sets the permissions of a content path. # # Params: # $1 Path to process. # # Globals: # content_dir_perms: permissions scheme to use for content directories. # content_file_perms permissions scheme to use for content files. function fix_content_permissions() { name=$(basename "$1") printf "\n Setting permissions on content directories to $content_dir_perms under '$name'" fix_content_permission_helper "$1" d "$content_dir_perms" printf "\n Setting permissions on content files to $content_file_perms under '$name'" fix_content_permission_helper "$1" f "$content_file_perms" } # Main code ########### # printf "Script to fix permissions in a Drupal installation" # Default values. DEFAULT_DRUPAL_PATH=. DEFAULT_HTTPD_GROPUP="www-data" # Initialize some values. group_executable_mode=x additional_files_paths="" file_folder_name='files' private_folder_name='private' simulate=0 # Parse Command Line Arguments while [ "$#" -gt 0 ]; do case "$1" in --drupal_path=* | -p=*) drupal_path="${1#*=}" ;; --drupal_user=* | -u=*) drupal_user="${1#*=}" ;; --httpd_group=* | -g=*) httpd_group="${1#*=}" ;; --files-path=* | -f=*) # Add a new line if there is any previous element. if [ ! -z "$additional_files_paths" ] then additional_files_paths+='\n' fi # Add path to the path list. additional_files_paths=$(printf "${additional_files_paths}${1#*=}") ;; --setgid | -s) group_executable_mode=xs ;; --dry-run | -n) simulate=$((simulate + 1)) ;; --help | -h) usage exit 0 ;; *) printf "\nError: Invalid parameter '$1'\n" exit 1 esac shift done # Initialize undefined values with default values. if [ -z $drupal_path ] then drupal_path=$DEFAULT_DRUPAL_PATH printf "\nUsing default Drupal path '$DEFAULT_DRUPAL_PATH'" fi if [ -z $httpd_group ] then httpd_group=$DEFAULT_HTTPD_GROPUP printf "\nUsing default HTTPD group '$DEFAULT_HTTPD_GROPUP'" fi # Calculate permissions by object type (directory or file) and function (code or # content files). code_dir_perms='u=rwx,g=rx,o=' code_file_perms='u=rw,g=r,o=' vendor_code_file_perms='o=' content_dir_perms="u=rwx,g=rw${group_executable_mode},o=" content_file_perms='ug=rw,o=' # Go to the right place (this a kind of initialization). cd $drupal_path complete_drupal_path=$(pwd) # Check if there's a vendor folder in the upper folder. [ -d "../vendor" ] && [ -f "../composer.json" ] && detected_vendor_path="../vendor" # Show current configuration. ############################# printf "\nRunning configuration: Path: $complete_drupal_path Owner user: $drupal_user Owner group: $httpd_group Code dirs perms: $code_dir_perms Code files perms: $code_file_perms Separated vendor folder detected: ${detected_vendor_path:-"No"} Content dirs perms: $content_dir_perms Content files perms: $content_file_perms File folder name: $file_folder_name Private files folder name: $private_folder_name " if [ ! -z "${additional_files_paths}" ] then printf "Additional content directories to process:\n${additional_files_paths}" fi # Sanity checks. ################ # is_root_user if [ $? -ne 0 ] then printf "\nError: you must run this script as the root user\n" exit 1 fi is_drupal_root $drupal_path if [ $? -ne 0 ] then printf "\nError: provided path '$drupal_path' is not the root directory of a Drupal installation\n" exit 1 fi if [ -z $drupal_user ] then printf "\nError: no user provided\n" exit 1 fi is_valid_user $drupal_user if [ $? -ne 0 ] then printf "\nError: provided user '$drupal_user' is not a valid user\n" exit 1 fi # Do the job ############ # printf "\n\nAll checks passed, go!" printf "\nProcessing Drupal installed on '$complete_drupal_path'" # First, fix ownership. printf "\nFixing ownership of files and directories" fix_onwership "$complete_drupal_path" echo "$additional_files_paths"| while read path; do [ -d "$path" ] && fix_onwership "$path" done # Second, fix permissions on code. printf "\nFixing permissions on code files and directories" fix_code_permissions "$complete_drupal_path" # Third, fix permissions on content. printf "\nFixing permissions on content files and directories under 'sites' folder" find "$complete_drupal_path/sites/" -maxdepth 1 -mindepth 1 -type d| while read site_folder do printf "\n Checking folder " printf $(basename "$site_folder") [ -d "$site_folder/$file_folder_name" ] && fix_content_permissions "$site_folder/$file_folder_name" [ -d "$site_folder/$private_folder_name" ] && fix_content_permissions "$site_folder/$private_folder_name" done [ -z "$additional_files_paths" ] && printf "\nProcessing additional content folders" echo "$additional_files_paths"| while read path; do [ -d "$path" ] && fix_content_permissions "$path" done printf "\n\nPermissions and ownership fixed!\n"
Помощь:
drupal_fix_permissions.sh -h
Пример:
drupal_fix_permissions.sh -u=www-data -g=www-data -p=/var/www/html/drupal/
