Skip to content

Scope filesystem permissions and drop sudo from the cache clear - #31

Merged
arhimede merged 1 commit into
mainfrom
scope-filesystem-permissions
Sep 16, 2026
Merged

arhimede merged 1 commit into
mainfrom
scope-filesystem-permissions

Conversation

@arhimede

Copy link
Copy Markdown
Member

Four code blocks made data and log world-writable, and one told the reader to clear the config cache as root.

  • chmod -R 777 on data and log is replaced with group ownership for the web-server user and 775. These are directories the web server writes into, and they hold the Twig and config caches, which are executable PHP — world-writable is a bad default to publish, and the pages offered no alternative and no scoping to local development. 777 is now mentioned once, in the FAQ, labelled as a throwaway-VM last resort.
  • Added a note that the web-server user is apache on AlmaLinux and RHEL derivatives, since the page recommends AlmaLinux and the example says www-data.
  • sudo php ./bin/clear-config-cache.php becomes composer clear-config-cache, with no sudo. Running it as root leaves the regenerated data/cache/config-cache.php owned by root and the application cannot rewrite it — which reproduces the exact permission errors the FAQ page exists to fix.

Signed-off-by: arhimede <julian@dotkernel.com>
@arhimede
arhimede merged commit 947439d into main Sep 16, 2026
7 checks passed
@alexmerlin
alexmerlin deleted the scope-filesystem-permissions branch September 16, 2026 11:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant