Nextcloud "data" directory permissions resetting to 770

returntrip · June 9, 2017, 3:59pm

Simple question. Does Nextcloud set the permissions for the data directory to 770 automatically, whenever the Apache service is re/started in Linux?
I had set my data dir permissions to 755 and as soon as I started the “httpd” service, the permissions reverted to 770.

tflidd · June 10, 2017, 9:35pm

Yes, I think it is set automatically to 770:

github.com

nextcloud/server/blob/1c2ccd220611a3c269c8122dcab8a3a6251053ef/lib/private/legacy/util.php#L968


	 * @param string $dataDirectory
	 * @return array arrays with error messages and hints
	 */
	public static function checkDataDirectoryPermissions($dataDirectory) {
		$l = \OC::$server->getL10N('lib');
		$errors = array();
		$permissionsModHint = $l->t('Please change the permissions to 0770 so that the directory'
			. ' cannot be listed by other users.');
		$perms = substr(decoct(@fileperms($dataDirectory)), -3);
		if (substr($perms, -1) !== '0') {
			chmod($dataDirectory, 0770);
			clearstatcache();
			$perms = substr(decoct(@fileperms($dataDirectory)), -3);
			if ($perms[2] !== '0') {
				$errors[] = [
					'error' => $l->t('Your data directory is readable by other users'),
					'hint' => $permissionsModHint
				];
			}
		}
		return $errors;

If you want to grant access for other users, it’s perhaps better to set the group permissions that this user can access it (depending on your setup, a chmod 750 would be better, e.g. if you use it for a backup process).

returntrip · June 10, 2017, 10:15pm

Thanks for finding that out! I have worked around this by mounting the partition with “acl” and setting an ACL.

uusijani · January 10, 2019, 11:47am

Sorry for necromancing, but because Google seems to like this thread, I just thought I’d add a mention that a check_data_directory_permissions option for config.php has since been implemented (and backported down to NC12), and it allows the admin to turn off the automatic permissions reset (by assigning it false).

This is discouraged however, and ACLs or other means of managing access are still the better option where available.