Drupal with safe mode enabled and open basedir

Last updated September 3, 2006. Created by ednique on September 3, 2006.
Log in to edit this page.

This is still undergooing some changes as I'm doing more tests...
But it works on a clean drupal 4.7.3 install...

I haven't tested all modules yet, so please help me out...

Simply: use safe mode based on groups rather then owner and give access to my central code base for virtual hosts so that open base dir works...

You need to be logged in using ssh as root...
And mind you my examples are from a plesk based system...
With a central code base located in /var/www/apps/drupal
and the virtual hosts directory in /var/www/vhosts/{domain}.{tld}/httpdocs/

1) create a group and a user called drupal...
After -d you can put any home directory you like, but I choose the directory where my drupal code is installed...
after the passwd you need to give a GOOD password for the user...

2) Change the owner and the group of the single code base...
If you don't have a single code base, only changing the group (chgrp) is enough

3) For the virtual hosts, change the group of the sites directory
Also all directories under sites should be chmod to 2775: 2 puts all new subfiles created automatically into the group of the folder they are placed in (drupal in our case) + 7 for owner (root or drupal or ftpusername) + 7 for group (drupal) + 5 for guests
If you have any more directories under sites, chmod them too

4) Add the users to the group
Plesk has a psaserv group don't worry if you don't have it...
The drupal group needs the psaadm and psaftp only if you run plesk

5) correct the tmp dir by creating a sub directory and putting the drupal group and user on it...

6) alter the code of file.inc so directories are made using 2775 rather then 775

7) change your virtual host settings of httpd.conf
In plesk this is done in: /var/www/vhosts/{domain}.{tld}/conf/vhost.conf
Other systems might have another place for the conf which is the configuration for your httpd server..
With this code I have made sure that only the drupal directories benefit from group based safe mode (safe_mode_gid)... all other directories still use the default safe mode
Remove the second DirectoryMatch in case you want all files and folders to benefit from group based safe mode...
As I have a central code base in /var/www/apps/drupal, I need to add this dir to the open basedir... and again only for the drupal directories off course...