Cron cache files owned by root:root

Question

I've started to get some weird errors in my system.log this morning after flushing the cache after uninstalling a possibly problem causing module.

I'm getting a lot of fopen errors showing missing permissions for opening several cache files in var/cache/mage--(numbers)/. After checking all the permissions for all the mage cache folders I noticed all those involving the cache were owned and grouped by root and not the actual website user and group.

Is this supposed to be set this way? or has something gone wrong somewhere along the way? (I'm thinking the latter as, well I'm getting an error, but i don't know if the error is the permissions of the file or permissions of the website user or the fact that this file is trying to be opened)

Answer 1

Cron jobs need to be set to run as the Magento login user or else the login user needs to be included as part of the group that the web server runs as.

As an example of setting the cron job runas user in the master crontab to be the user the web server runs as (in this case www-data):

# m h dom mon dow user  command
*/15 *  * * *   www-data /bin/sh /var/www/magento/public_html/cron.sh

Another source of miscreation of files is to have command line scripts that either you have created, or that are being run from shell/ being run by a different user.

It sounds like your web server process is running as root and creating the cache files/subdirectories as root. This is a server misconfiguration, usually the web server is set up to start as root and then change its user/group to a less priveledged user such as nobody.

Sonassi has a blog article discussing how to stop permissions issues

The major highlights are

1. to change the ftp/ssh user to belong to the apache, nobody, www-data group (depends on server setup as to what this group name is)

2. Change directory permissions to 775, file permissions to 664 and cron.sh to 775

3. Set ACLs so files are automatically created with the proper permissions (if your OS has ACL support) or set your umask(022) so Magento creates the files to match your installation and set umask(022) in your bashrc so your ssh login creates files with proper permissions.

Answer 2

I had a similar problem with logs files after I applied a security patch. The patch change lines like
@chmod($this->_reportFile, 0777);
to
@chmod($this->_reportFile, 0640);
Try checking those changes if you applied a patch along the way.