Log Permission Denied

I have my Web Application host in Linux by Nginx. there is some process running:

Queue job triggered by dispatch.
Cron to the scheduler that runs every minute.

Logging Configuration is Daily. And inside bootstrap/app.php I configure this

$app->configureMonologUsing(function(Monolog\Logger $monolog) {
    $filename = storage_path('logs/laravel-'.php_sapi_name().'-'.get_current_user().'.log');
    $handler = new Monolog\Handler\RotatingFileHandler($filename);
    $monolog->pushHandler($handler);
});

Every day the log created with "root" name from get_current_user(). and every new day, if the new log file created by Cron, the Queue job will not work because Permission Denied writing the log file.

I tried to fix, by adjusting the Cron by installing as www-data user install inside

crontab -u www-data -e

by the log file still, create with "root" name.

and then I tried inside the Cron command, I add

* * * * * -u www-data php /directory/to/my/application/artisan schedule:run

the only solution that I know for now, only change the permission to 755 every day or every time the error occurred.

is there any other solution?

Snapey

6 years ago

Level 122

In the logging config file you can set the permissions of the created file;

'daily' => [
    'driver' => 'daily',
    'path' => storage_path('logs/laravel.log'),
    'level' => 'debug',
    'days' => 7,
    'permission' => 0664,
],

You can put root and www-data in the same group then make the logfile group writable?

kinshara

6 years ago

Level 1

Sorry, I didnt give more information about the application.

I use laravel 5.5 for this application, there is no Logging Config File in app.

"You can put root and www-data in the same group then make the logfile group writable?" Even, I put the cron inside

cron -u www-data -e

still, the log that created by the Cron contains "root" name..

itsfg

6 years ago

Level 5

We had this problem too in some applications. This was our solution :

Our webserver user is called "www", member of a group called "laravel". Composer user is also member of this "laravel" group :

## create user group
sudo groupadd laravel

## add composer user to group
sudo gpasswd -a yourlogin laravel

## add web server to group
sudo gpasswd -a www laravel

First, reset/set all permissions in your project :

## jump to laravel path
cd /path/to/your/laravel-application

## optional: if you've been playing around with permissions
## consider resetting all files and directories to the default
sudo find ./ -type d -exec chmod 755 {} \;
sudo find ./ -type f -exec chmod 644 {} \;

## give users part of the laravel group the standard RW and RWX
## permissions for the existing files and folders respectively
sudo chown -R :laravel ./storage
sudo chown -R :laravel ./bootstrap/cache
sudo find ./storage -type d -exec chmod 775 {} \;
sudo find ./bootstrap/cache -type d -exec chmod 775 {} \;
sudo find ./storage -type f -exec chmod 664 {} \;
sudo find ./bootstrap/cache -type f -exec chmod 664 {} \;

And then, this is how we declare that every new file created should have the same permissions as the parent directory :

## give the newly created files/directories the group of the parent directory 
## e.g. the laravel group
sudo find ./bootstrap/cache -type d -exec chmod g+s {} \;
sudo find ./storage -type d -exec chmod g+s {} \;

## let newly created files/directories inherit the default owner 
## permissions up to maximum permission of rwx e.g. new files get 664, 
## folders get 775
sudo setfacl -R -d -m g::rwx ./storage
sudo setfacl -R -d -m g::rwx ./bootstrap/cache

## Reboot so group file permissions refresh (required on Debian and Centos)
sudo shutdown now -r

Now, even if the root user creates the log file, it is readable/writable by the webserver user.

We now always execute this script file after a fresh laravel install.

Maybe it helps ?

kinshara

6 years ago

Level 1

thank you for the response.

lemme try first. I will update soon I got the result.

how can you find or set your webserver user "www"? actually I dont even know, is mine "www" or "www-data"

Snapey

6 years ago

Level 122

you can find out what user the webserver is running under by looking at some of the session files

eg ls -la storage/framework/sessions

Please or to participate in this conversation.