SID-02437: Setting for umask?

Status:	Answered	TWiki version:	6.1.0	Perl version:
Category:	CategoryInstallation	Server OS:	FreeBSD - Hosted	Last update:	6 years ago

I'm trying to install TWiki on a Nearly Free Speech shared hosted website. I am having trouble with RCS getting errors when saving a new revision of a topic, or when creating a new web.

It looks like what is happening is that their Apache user is "web", and when a new file (directory, in the case of a new web) is created, it is created with web [25000] as both the owner and the group. However, RCS gets an error while trying to get a lock on the file.

In researching the issue, I found the following in the NFSHost FAQ page:

As a security precaution, CGI and PHP scripts run with different user credentials than you do when you edit your files. Although the CGI/PHP user has significantly fewer privileges overall, it is possible to create a situation where an application creates files or directories that you do not have permission to access or remove via FTP or ssh. This typically happens if an application's umask is set incorrectly; the resulting files or directories will be owned by the "web" user and will not be group or world writable. (Correct umasks are 0 or 002, depending on the expected group ownership. A umask of 0 should work for most web applications, and does not compromise security on our system the way it does on some shared hosts.)

I think it applies to my situation because "...the resulting files or directories will be owned by the "web" user and will not be group or world writable." - which appears to be what is happening.

So, I researched umask and it appears to be set in the init.d script, which I could not find. The example I found in TWiki Support looks like you need to restart Apache after making a change to it - which I can't do, because my install is on a shared server.

-- David Tremain - 2020-03-21

Discussion and Answer

I had a similar case with a different hosting provider, no need to change the umask. Fix: Ask their support to change the ownership of all directories and files below twiki/data and twiki/pub to be owned by the webserver user. If you want to continue to use the configure script, you need to do the same for twiki/lib, or the least for twiki/lib/LocalSite.cfg. FYI, once TWiki is configured, you can change the configuration by directly editing twiki/lib/LocalSite.cfg.

-- Peter Thoeny - 2020-03-21

NFSHost said, You don't need to do that. It's adequate to change the group and grant group write permissions

So, that leaves me in the middle of a standoff.

What is the default umask set to in TWiki?

Can it be changed / set globally for the TWiki installation? Concerns / reservations about doing so?

-- David Tremain - 2020-03-23

Well, NFSHost is correct as long as it is a single CGI script. In our case the CGI script calls external programs (rcs, ci, co).

Maybe try using configure setting {StoreImpl} with RcsLite instead of RcsWrap. RcsLite is pure Perl rcs, albeit a bit slower.

-- Peter Thoeny - 2020-03-23

You, as usual, are a genius! RcsLite appears to resolve the issue... Thank you!

-- David Tremain - 2020-03-24

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.