403 Forbidden on Extracted tar/zip files

Discussion in 'Apache' started by jitspoe, May 1, 2007.

  1. #1
    I can't make any sense of this. I just set up a new server and configured it like my old one (which worked perfectly). Whenever I download and extract something to /var/www/html (phpMyAdmin, for example), I get a 403 forbidden to it, even though it has the same permissions and owner as everything else. I've even tried to recursively chown everything to apache and chmod 777 everything. Always forbidden.

    What's strange is if I create a fresh directory (same permissions, just created with mkdir instead of extracted from a tar), and *copy* the files over, they work. If I move them from the extracted directory or create new files in the extracted directory, they are forbidden. The only workaround I've found is to re-tar everything locally and then un-tar it again. This creates "fresh" copies of the files and even though all the permissions and owners are the same, the forbidden error goes away. It's like there's some hidden flag somewhere that doesn't show up with an "ls -la". I've compared two directories side by side and everything is identical, yet one will be forbidden and the other not. Directory and file names do not matter, and there are no .htaccess files.

    It's not just files downloaded from web sites, either. I tar.gz'd some data off of my old server and copied it to the new one. Usernames, permissions, and everything are configured the same on both servers, but extracted files result in a forbidden. I have to tar/untar them locally (or use some other method to copy them) to get them to work.

    I'm using CentOS 4 with Apache 2.0.59.
     
    jitspoe, May 1, 2007 IP
  2. rootbinbash

    rootbinbash Peon

    Messages:
    2,198
    Likes Received:
    88
    Best Answers:
    0
    Trophy Points:
    0
    #2
    can you post exact chown command (with parameters) you are using.Also is apache running as user nobody?
     
    rootbinbash, May 1, 2007 IP
  3. jitspoe

    jitspoe Peon

    Messages:
    4
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Apache is running as the user "apache". The chown command I was using was "chown -R apache <directory>", I believe. It set everything correctly, but had no impact on the forbidden directories. It did, however, make previously readable directories writable with php.

    To help clarify the situation a bit more, here's an example of a forbidden directory, and one that is not.

    This directory was extracted from a tar file and results in a forbidden:
    [admin@dpserverscom script3]$ ls -al
    total 228
    drwxrwxr-x  2 admin admin  4096 Apr 28 23:41 .
    drwxr-xr-x  7 admin root   4096 Apr 29 00:14 ..
    -rw-r--r--  1 admin admin  1813 Apr 23 23:06 check_lang.php
    -rwxr-xr-x  1 admin admin   400 Apr 23 23:06 convertcfg.pl
    -rwxr-xr-x  1 admin admin  8421 Apr 23 23:06 create-release.sh
    -rw-r--r--  1 admin admin  6081 Apr 23 23:06 create_tables_mysql_4_1_2+.sql
    -rw-r--r--  1 admin admin  5203 Apr 23 23:06 create_tables.sql
    -rw-r--r--  1 admin admin  2737 Apr 23 23:06 decode_bug.php
    -rwxr-xr-x  1 admin admin  1090 Apr 23 23:06 find_unused_messages.sh
    -rw-rw-r--  1 admin admin     9 Apr 28 23:41 index.php
    -rwxr-xr-x  1 admin admin  2125 Apr 23 23:06 lang-cleanup.sh
    -rwxr-xr-x  1 admin admin   392 Apr 23 23:06 remove_control_m.sh
    -rw-r--r--  1 admin admin 75819 Apr 23 23:06 setup.php
    -rw-r--r--  1 admin admin  1728 Apr 23 23:06 signon.php
    -rwxr-xr-x  1 admin admin  5017 Apr 23 23:06 upgrade.pl
    -rw-r--r--  1 admin admin  6316 Apr 23 23:06 upgrade_tables_mysql_4_1_2+.sql
    Code (markup):
    This is a fresh directory created in the same location as the above (both in the html root directory) and with the above data copied over to it. This directory is readable from apache:
    [admin@dpserverscom script2]$ ls -al
    total 228
    drwxrwxr-x  2 admin admin  4096 Apr 28 23:40 .
    drwxr-xr-x  7 admin root   4096 Apr 29 00:14 ..
    -rw-r--r--  1 admin admin  1813 Apr 28 23:40 check_lang.php
    -rwxr-xr-x  1 admin admin   400 Apr 28 23:40 convertcfg.pl
    -rwxr-xr-x  1 admin admin  8421 Apr 28 23:40 create-release.sh
    -rw-r--r--  1 admin admin  6081 Apr 28 23:40 create_tables_mysql_4_1_2+.sql
    -rw-r--r--  1 admin admin  5203 Apr 28 23:40 create_tables.sql
    -rw-r--r--  1 admin admin  2737 Apr 28 23:40 decode_bug.php
    -rwxr-xr-x  1 admin admin  1090 Apr 28 23:40 find_unused_messages.sh
    -rw-rw-r--  1 admin admin     9 Apr 28 23:39 index.php
    -rwxr-xr-x  1 admin admin  2125 Apr 28 23:40 lang-cleanup.sh
    -rwxr-xr-x  1 admin admin   392 Apr 28 23:40 remove_control_m.sh
    -rw-r--r--  1 admin admin 75819 Apr 28 23:40 setup.php
    -rw-r--r--  1 admin admin  1728 Apr 28 23:40 signon.php
    -rwxr-xr-x  1 admin admin  5017 Apr 28 23:40 upgrade.pl
    -rw-r--r--  1 admin admin  6316 Apr 28 23:40 upgrade_tables_mysql_4_1_2+.sql
    Code (markup):
    As you can see, the owner, permissions, and contents are identical, yet one results in a forbidden and the other not. The owner is admin in this case, but apache still functions with that owner, so that's not the issue.
     
    jitspoe, May 1, 2007 IP
  4. rootbinbash

    rootbinbash Peon

    Messages:
    2,198
    Likes Received:
    88
    Best Answers:
    0
    Trophy Points:
    0
    #4
    change the group of the folder.It will work as i can see (or add apache to that group or change the folder permissions)

    http://en.wikipedia.org/wiki/Chgrp

    EDIT : maybe i am wrong,i am drunk.I will check this topic tomorrow,sorry
     
    rootbinbash, May 1, 2007 IP
  5. jitspoe

    jitspoe Peon

    Messages:
    4
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    The issue was with SELinux. "ls -Z" shows the differences. To fix it, I had to use the following command:

    chcon -R -h -t httpd_sys_content_t <directory>
     
    jitspoe, May 2, 2007 IP
  6. rootbinbash

    rootbinbash Peon

    Messages:
    2,198
    Likes Received:
    88
    Best Answers:
    0
    Trophy Points:
    0
    #6
    ow man you i didn't think you are using SElinux.You should mention it before : ) YEs you are right
     
    rootbinbash, May 4, 2007 IP
  7. jitspoe

    jitspoe Peon

    Messages:
    4
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #7
    I didn't think I was, either. I hadn't even heard of it before until I pleaded for help on a bunch of forums, haha.
     
    jitspoe, May 4, 2007 IP