How to override default permissions for files stored in Apache / PHP in / tmp?

Question

I'm on Linux, obviously. PHP scripts seem to work under the user "www-data". I also see that the downloaded files fall into the default directory / tmp, each of which has a name appended with "php". All standard, I think. Permissions for all of these files are: -rw ------- ie 600, user-www-data ', group' www-data '. The problem is that I have a PostgresQL database server running under the postgres user, which should be able to read these files because it inserts their contents into the database. Obviously, this is currently not possible. Of course, as a rule, database queries and functions work under who connects to the database (I also connect as "www-data"), but here we are talking about server-side functions that should be called as "postgres", This is a limitation of PostgresQL, better or worse.

I believe that security is important, but I think that the world will not work if I allow either postgres to read these files or relax the permissions of these files.

How to manage the permissions with which these files are created? Obviously, PHP creates them yourself, for example. when loading a POST file, but I can not find any configuration switches. In addition, my / tmp has permissions of 'drwxrwxrwt' (777) and belongs to the user 'root', group 'root'.

I tried changing the upload directory with php_value upload_tmp_dir, but it has no effect, it seems that PHP still stores temporary files in / tmp.

I do NOT want to use with 'move_uploaded_file' or 'chmod', since they write to the file system, and I want to avoid this, except for the server (s) of the database inserting the records.

Answer 1

You can try changing the umask settings for Apache in / etc / apache 2 / envvars

I have not tried this, but adding it to the envvars file will look like this:

# envvars - default environment variables for apache2ctl # Since there is no sane way to get the parsed apache2 config in scripts, some # settings are defined via environment variables and then used in apache2ctl, # /etc/init.d/apache2, /etc/logrotate.d/apache2, etc. export APACHE_RUN_USER=www-data export APACHE_RUN_GROUP=www-data export APACHE_PID_FILE=/var/run/apache2.pid ## The locale used by some modules like mod_dav export LANG=C ## Uncomment the following line to use the system default locale instead: #. /etc/default/locale export LANG umask 022 

As far as I know, this will force Apache to create files with a resolution of 644. rw-rr -

Answer 2

Change your script to chmod() files after loading?