Bug 522897 - Unable To Upload Images To /usr/share/wordpress/wp-content/uploads/
Unable To Upload Images To /usr/share/wordpress/wp-content/uploads/
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: wordpress (Show other bugs)
15
All Linux
low Severity medium
: ---
: ---
Assigned To: Gwyn Ciesla
Fedora Extras Quality Assurance
: SELinux
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-09-11 22:12 EDT by Bob Cochran
Modified: 2011-07-12 01:12 EDT (History)
8 users (show)

See Also:
Fixed In Version: wordpress-3.1.4-1.fc14
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-06-21 13:14:16 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Bob Cochran 2009-09-11 22:12:42 EDT
Description of problem:

I cannot upload images to the directory 

/usr/share/wordpress/wp-content/uploads/ 

using the Fedora version of Wordpress, with its own upload screens and code. This is true even if I am a Wordpress user who has been assigned the "author" role by the blog's admin person. For example, logging in as user 'bob' who has 'author' privileges and clicking the link to create a new post, and then clicking the icon for uploading an image, and then browsing to the local file "myphoto.jpg", and then clicking the "upload" button will result in an error message in red text stating (the very first time you attempt the first upload in a brand new Wordpress installation) that the directory /usr/share/wordpress/wp-content/uploads/[year]/[month] cannot be created. If you create these two directories e.g. 

/usr/share/wordpress/wp-content/uploads/2009/09

you will then get a new error message stating that the file cannot be moved to /usr/share/wordpress/wp-content/uploads/2009/09.
   
This is true whether you use the "flash upload" feature of Wordpress or the "browser upload" feature. 

The failure also occurs if you create your own php script for uploading files to this directory, say a script named testuploads.php, move this to the web server's document root /var/www/html, and then try to upload as the apache user. 

If you explore php's upload features a bit and set the 'upload_tmp_dir' directive of /etc/php.ini to some value in /tmp, say /tmp/php_uploads, you start to get a clue to the real source of the problem: when php attempts to upload to the temp directory, you get SELinux AVC denials when running in SELinux enforcing mode.
   

Version-Release number of selected component (if applicable):


wordpress-2.8.3-2.fc11.noarch

(This problem very likely affects the rawhide version too, built for Fedora 12) 


How reproducible:

Every time you attempt an upload through Wordpress to /usr/share/wordpress/wp-content/uploads/.

Steps to Reproduce:

1. See above problem description

  
Actual results:

Upload fails with error messages indicated above.

Expected results:

The apache user should have create directory, create file, read and write file access to the directory intended for Wordpress file uploads. This has to be addressed through a combination of placing the upload directory in the right location, setting file permissions correctly, and setting SELinux file contexts correctly. 

Additional info:

I was able to fix this with help from Dominick Grift (domg472@gmail.com) and Dan Walsh (dwalsh@redhat.com) and by browsing the SELinux documentation here: http://docs.fedoraproject.org/selinux-managing-confined-services-guide/en-US/F11/html/sect-Managing_Confined_Services-The_Apache_HTTP_Server-Types.html

Step 1.

chcon -R -t httpd_sys_content_rw_t /usr/share/wordpress/wp-content/uploads/
chcon -R -t httpd_sys_content_rw_t /tmp/php_uploads 
service httpd start 

Testing with chcon shows this will get uploads going, if the user apache also has group write access to the directory. The directory /tmp/php_uploads is the directory I specified in /etc/php.ini for 'upload_tmp_dir'.

Here is the content of my Wordpress upload directory:

[root@deafeng3 ~]# ls -al /usr/share/wordpress/wp-content/uploads/2009/09/
total 68
drwxrwxr-x. 2 apache apache  4096 2009-09-11 17:17 .
drwxrwxr-x. 3 apache apache  4096 2009-09-05 03:58 ..
-rw-rw-r--. 1 apache apache  4743 2009-09-11 17:17 chigger_bites_close_up_one_foot_2009-09-02_small_v1-150x150.jpg
-rw-rw-r--. 1 apache apache 48020 2009-09-11 17:17 chigger_bites_close_up_one_foot_2009-09-02_small_v1.jpg
-rw-r--r--. 1 apache apache    85 2009-09-07 11:03 .htaccess

Note: I created the .htaccess file based on researching the Wordpress website, but it was not helpful for this problem.

Step 2.

Issue all of these commands:

semanage fcontext -a -t httpd_sys_content_rw_t /tmp/php_uploads
restorecon -R -v /tmp/php_uploads
semanage fcontext -a -t httpd_sys_content_rw_t "/usr/share/wordpress/wp-content/uploads(/.*)?"
restorecon -R -v /usr/share/wordpress/wp-content/uploads/

Step 3.

Retry the Wordpress upload procedure by creating a test Wordpress post that includes a new image upload. It should still work.

Step 4.

Reboot the machine and again retry the Wordpress upload procedure by creating a test Wordpress post (a third one) that includes a new image upload. It should still work.

No doubt I did some unnecessary steps above -- someone much more experienced than me can probably distill this to the bare minimum number of steps needed to achieve results.

Finally, /usr doesn't seem the finest place to put the wordpress upload directory. Why not move it under /var/www/html? That is what I would do. If that happens and you make the directories writable to the apache user, the right SELinux contexts are either already there, or you can add them as part of the rpm installation procedure.
Comment 1 Daniel Walsh 2009-09-11 23:15:24 EDT
Miroslav add the following labeling to F11.

/usr/share/wordpress/wp-content/uploads(/.*)?	system_u:object_r:httpd_sys_content_rw_t:s0


But I agree that we should not have writable files under /usr.   /usr should be read/only whenever possible.  Putting the content under /var/www/html/wordpress would make sense.
Comment 2 Bob Cochran 2009-09-11 23:42:53 EDT
Can the labelling be done in F12 also? I do have the F12 Alpha running and I'm going to play with it on Sunday. I'll file a bug against this for rawhide if you would like.

Bob
Comment 3 Daniel Walsh 2009-09-14 11:25:52 EDT
I always put any fix for the current released Fedora into Rawhide.  No need for a separate bugzilla.
Comment 4 Miroslav Grepl 2009-09-16 09:20:39 EDT
The tabeling was added to selinux-policy-3.6.12-83.fc11.noarch
Comment 5 Gianluca Sforna 2010-04-01 08:13:27 EDT
Ok, hitting the same issue here; I agree keeping the upload dir in /usr is not a good thing, but isn't  /var/www supposed to be read only as well?
Comment 6 Daniel Walsh 2010-04-01 10:18:19 EDT
I would argue /var means variable, so while most of /var/www is readonly, I have no problems allowing read/write content anywhere under /var
Comment 7 Bug Zapper 2010-04-28 06:18:34 EDT
This message is a reminder that Fedora 11 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 11.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '11'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 11's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 11 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 8 Fedora Admin XMLRPC Client 2010-08-04 11:00:37 EDT
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 9 Bug Zapper 2010-11-04 06:04:46 EDT
This message is a reminder that Fedora 12 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 12.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '12'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 12's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 12 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 10 Nathaniel McCallum 2011-05-13 11:01:41 EDT
This is quite an easy fix.  Move wp-content to /var/www/wordpress (which should get the labelling correct by default, I think) and edit the WP_CONTENT_DIR definition in /usr/share/wordpress/wp-includes/default-constants.php.

This bug affects other things as well, like multi-user wordpress (which requires a writable directory in wp-contents).
Comment 11 Matěj Cepl 2011-05-25 18:40:46 EDT
(In reply to comment #10)
> This is quite an easy fix.  Move wp-content to /var/www/wordpress (which should
> get the labelling correct by default, I think) and edit the WP_CONTENT_DIR
> definition in /usr/share/wordpress/wp-includes/default-constants.php.
> 
> This bug affects other things as well, like multi-user wordpress (which
> requires a writable directory in wp-contents).

Please review suggested patch in http://pkgs.fedoraproject.org/gitweb/?p=wordpress.git;a=commitdiff;h=effc25273226e891448d8b596e7c7b1db9de6018 (koji build http://koji.fedoraproject.org/koji/taskinfo?taskID=3092834).
Comment 12 Nathaniel McCallum 2011-05-25 19:00:01 EDT
Looks good. One question however is what the permissions are on /var/www/wordpress? Should this directory be writable by default?  I'm guessing yes, and that with wordpress being under selinux by default the risk should be pretty low...
Comment 13 Matěj Cepl 2011-05-26 08:03:06 EDT
(In reply to comment #12)
> Looks good. One question however is what the permissions are on
> /var/www/wordpress? Should this directory be writable by default?  I'm guessing
> yes, and that with wordpress being under selinux by default the risk should be
> pretty low...

What about chmod 664 files and group apache?

Although, do you know what group runs lightppd under? Wordpress is supposed to be compatible with it, right?

Adding lighttpd maintainer to CC to help us.
Comment 14 Fedora Update System 2011-06-02 03:55:15 EDT
wordpress-3.1.3-2.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-2.fc15
Comment 15 Fedora Update System 2011-06-02 03:58:52 EDT
wordpress-3.1.3-2.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-2.el5
Comment 16 Fedora Update System 2011-06-02 03:59:36 EDT
wordpress-3.1.3-2.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-2.fc13
Comment 17 Fedora Update System 2011-06-02 04:00:15 EDT
wordpress-3.1.3-2.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-2.fc14
Comment 18 Fedora Update System 2011-06-02 04:04:44 EDT
wordpress-3.1.3-2.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-2.el6
Comment 19 Fedora Update System 2011-06-02 08:53:24 EDT
wordpress-3.1.3-3.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-3.el5
Comment 20 Fedora Update System 2011-06-02 08:54:04 EDT
wordpress-3.1.3-3.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-3.el6
Comment 21 Fedora Update System 2011-06-02 08:54:29 EDT
wordpress-3.1.3-3.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-3.fc13
Comment 22 Fedora Update System 2011-06-02 08:54:54 EDT
wordpress-3.1.3-3.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-3.fc14
Comment 23 Fedora Update System 2011-06-02 08:55:22 EDT
wordpress-3.1.3-3.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/wordpress-3.1.3-3.fc15
Comment 24 Matěj Cepl 2011-06-02 09:02:25 EDT
And all those updates are in vain for this bug (sorry, for screwing fedpkg update) ... in the end I have not managed to make wordpress moving with Patch 1 applied. If you can do it, please do so.
Comment 25 Matěj Cepl 2011-06-02 09:03:50 EDT
Respectively, I am able to upload images to wp-content/uploads (because SELinux policy has been changed), but I haven't been able to move wp-content to /var/www/wordpress.
Comment 26 Fedora Update System 2011-06-03 01:28:32 EDT
Package wordpress-3.1.3-3.fc15:
* should fix your issue,
* was pushed to the Fedora 15 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing wordpress-3.1.3-3.fc15'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/wordpress-3.1.3-3.fc15
then log in and leave karma (feedback).
Comment 27 Fedora Update System 2011-06-03 21:42:45 EDT
Package wordpress-3.1.3-3.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing wordpress-3.1.3-3.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/wordpress-3.1.3-3.el6
then log in and leave karma (feedback).
Comment 28 Fedora Update System 2011-06-21 13:13:57 EDT
wordpress-3.1.3-3.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 29 Fedora Update System 2011-06-29 15:50:14 EDT
wordpress-3.1.4-1.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/wordpress-3.1.4-1.fc14
Comment 30 Fedora Update System 2011-06-29 15:52:49 EDT
wordpress-3.1.4-1.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/wordpress-3.1.4-1.fc15
Comment 31 Fedora Update System 2011-06-29 15:59:00 EDT
wordpress-3.1.4-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/wordpress-3.1.4-1.el6
Comment 32 Fedora Update System 2011-07-06 14:02:11 EDT
wordpress-3.1.4-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 33 Fedora Update System 2011-07-06 17:30:36 EDT
wordpress-3.1.4-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 34 Fedora Update System 2011-07-12 01:12:35 EDT
wordpress-3.1.4-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.