PHP can read but not write, although permissions are correct

Question

I've got a PHP script that should update a userlist and grouplist file. I can read both of these files, but I get permission denied errors when trying to write to them:

Warning: file_put_contents(/etc/httpd/conf/userlist): failed to open stream: Permission denied in /var/www/html/add_admin.php on line 60

I get the same error for grouplist.

I'm quite certain the permissions for everything are set correctly on the server, but it's still not working.

Permissions of the php page:

-rwxrwxrwx. 1 apache     webdev  2022 Sep  1 11:30 add_admin.php

Permissions of /etc/httpd/conf:

drwxrwxrwx. 2 apache webdev 4096 Sep  1 11:28 conf

Permissions inside /etc/httpd/conf:

-rwxrwxr--. 1 apache apache    32 Aug 30 13:45 grouplist
-rwxrwxr--. 1 root   root   35661 Aug 30 14:26 httpd.conf
-rwxrwxr--. 1 root   root   35405 Aug 30 12:19 httpd.conf.bak
-rwxrwxr--. 1 root   root   13139 Oct 16  2014 magic
-rwxrwxr--. 1 apache apache   385 May 26 14:23 userlist
-rwxrwxr--. 1 root   root     328 May 26 13:54 userlist.bak

The Code:

<html>    
        <head>
                <title>Admin Creation Tool</title>
                <style>
                        #userInfo{
                                width: 300px;
                        }
                </style>
        </head>

        <body>
                <form action="add_admin.php" method="post" enctype="multipart/form-data" id="uploadForm">
                        <input type="text" placeholder="username" name="username" id="username" required/><br>
                        <input type="password" placeholder="password" name="password1" id="password1" required/><br>
                        <input type="password" placeholder="Re-enter password" name="password2" id="password2" required/><br>
                        <input type="checkbox" id="isAdmin" name="isAdmin"/>Administrator<br>
                        <input type="submit" value="Add User" name="submit" id="submit" />
                </form>

                <script>
                        var password = document.getElementById("password1")
                        , confirm_password = document.getElementById("password2");

                        function validatePassword(){
                          if(password.value != confirm_password.value) {
                            confirm_password.setCustomValidity("Passwords Don't Match");
                          } else {
                            confirm_password.setCustomValidity('');
                          }
                        }

                        password.onchange = validatePassword;
                        confirm_password.onkeyup = validatePassword;
                </script>

                <?php

                        error_reporting(E_ALL);
                        ini_set('display_errors', 1);

                        if(isset($_POST["submit"])) {

                                $groupFileDir = "/etc/httpd/conf/grouplist";
                                $userListDir = "/etc/httpd/conf/userlist";

                                $username = $_POST["username"];
                                $password = $_POST["password1"];
                                $encryptedPassword = crypt($password, base64_encode($password));
                                echo file_get_contents($userListDir); //This is just a test for reading

                                file_put_contents($userListDir, $username . ":" . $encryptedPassword . "\n", FILE_APPEND);

                                echo "User Added";

                                if(isset($_POST["isAdmin"])){
                                        file_put_contents($groupFileDir, " " . $username, FILE_APPEND);
                                        echo " as Administrator";
                                }    
                        }
                ?>

        </body>
</html>

I'm not great with linux, so it's possible I'm missing something, but I ran it by my friendly neighborhood linux guru, and he's baffled as well.

File seems to be already open and not closed properly... only guessing here. — Marc Giroux, Sep 01 '16 at 15:21
Who is the user that is getting the permission denied error? Try echoing get_current_user() (from the application) to see who the owner that is getting denied — The One and Only ChemistryBlob, Sep 01 '16 at 15:21
@TheOneandOnlyChemistryBlob - apache is showing as the current user using the method you mentioned. — JEJoll, Sep 01 '16 at 15:26
@MarcGiroux - I suppose this is possible. Any way to check this? If not, maybe I'll try restarting the server — JEJoll, Sep 01 '16 at 15:26
@MarcGiroux Running this command did nothing. I'm assuming this means the file is not open? — JEJoll, Sep 01 '16 at 15:31
@Machavity - It does appear to be SELinux. The selinux file says SELINUX=enforcing. I'm unfamiliar with this. Does it prevent write access from php? — JEJoll, Sep 01 '16 at 15:33
Talking about directory /etc and /etc/httpd, has apache user the 'x' permission? — Mariella, Sep 01 '16 at 15:34
@Mariella - Originally, it didn't, but I've given x permission to all but everybody with no difference. — JEJoll, Sep 01 '16 at 15:37
@JEJoll Are you an administrator on the server or do you know someone with admin rights? — Machavity, Sep 01 '16 at 15:42
Check out the duplicate link (wanted to make sure you were an admin first). Also, [Server Fault has a similar relevant question](http://serverfault.com/questions/642353/selinux-interfering-with-apache-php) — Machavity, Sep 01 '16 at 15:54

PHP can read but not write, although permissions are correct

0 Answers0