File permissions #

This page is for developers and administrators who set up a DXP project on a server or a workstation. Two users write to the project: you on the command line (php bin/console) and the web server. Both must be able to write the same directories.

Contents #

1. Which directories
2. With ACLs (recommended)
3. Without ACLs
4. Checking
5. Common mistakes

Which directories #

Everything else (src/, config/, templates/, vendor/) is written only when you deploy.

With ACLs (recommended) #

Replace www-data with your web server's user (apache, nginx, _www on macOS):

setfacl -R  -m u:www-data:rwX -m g:www-data:rwX var/ public/var/
setfacl -dR -m u:www-data:rwX -m g:www-data:rwX var/ public/var/

The first line sets the rights on what exists, the second (-d) makes them the default for new files. Install the acl package if setfacl is missing (apt install acl, dnf install acl).

Without ACLs #

On file systems without ACLs (some NFS and BSD mounts, macOS APFS):

chown -R www-data:www-data var/ public/var/
chmod -R 775 var/ public/var/

Then add your command line user to the web server's group, or run console commands as that user (sudo -u www-data php bin/console cache:clear).

Checking #

getfacl var/ | head                       # the ACL entries
sudo -u www-data touch var/log/.write-test && sudo -u www-data rm var/log/.write-test
ls -l var/data_*.db                       # SQLite: owner and group

Common mistakes #

• Running cache:clear as root. The cache files then belong to root and the web server cannot rewrite them. Run console commands as your normal user or the web server user.
• Forgetting public/var/. Uploads fail and image variations return errors.
• Making everything 777. Never needed; use ACLs or the group.

Related pages #

• Installing with the skeleton
• SQLite for development
• Troubleshooting
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.