3

I installed mediawiki & semantic mediawiki on a laptop with Ubuntu 20.04.

Questions

  • Should the www-data user own every file of mediawiki? Is it better to let root own the files?
  • Should I run composer with the www-data user? I mean sudo -u www-data composer update --nodev? When I run composer with root, composer says that is bad.

Installation of Mediawiki

  1. Install semantic, following https://www.mediawiki.org/wiki/Manual:Running_MediaWiki_on_Debian_or_Ubuntu
  2. chown -R www-data:www-data /var/lib/mediawiki/images/ for uploading images and other files.
  3. Now everything in /var/lib/mediawiki is owned by root:root, except for the images/ folder.
  4. Set up short url by modifying /etc/apache2/sites-avaliable/000-default.conf and follow the guide at https://www.mediawiki.org/wiki/Manual:Short_URL/Apache

Installation of Semantic Mediawiki

  1. sudo apt-get install composer
  2. Create /var/lib/mediawiki/composer.local.json with the following content:
{
    "require":{
        "mediawiki/semantic-mediaw-wiki": "~3.2"
    }
}

as described in https://www.semantic-mediawiki.org/wiki/Help:Installation/Quick_guide

  1. chown -R www-data:www-data /var/lib/mediawiki
  2. While the guide asked me to run composer update --nodev, I run the command with the www-data user and within the /var/lib/mediawiki folder:
cd /var/lib/mediawiki && sudo -u www-data composer update --nodev
  1. sudo -u www-data php maintenance/update.php

1 Answer 1

2

This is a good question, and something I still wonder if I'm doing the "right way" or the best way. But to attempt to give you two potential answers to your questions:

Should the www-data user own every file of mediawiki? Is it better to let root own the files?

It seems fine either way. The www-data user only needs to be able to write to images and cache, though. I think it's considered best practice to put cache outside your web root and set its path with $wgCacheDirectory anyway.

To avoid having to run any maintenance tasks as root, and to prevent the web server user itself from being able to write to places where it doesn't need to, I have a dedicated group for this, let's call it "adm".

I would use an account in this group (say, my personal account) for doing all that "maintenance stuff" like editing LocalSettings.php and running scripts from the maintenance directory. So the setup for a new MediaWiki installation might look something like this:

# assuming Debian/Ubuntu
sudo mkdir /var/www/html/w      # you used /var/lib/mediawiki here
sudo mkdir g+w w                # not sure if this is always necessary
sudo setfacl -m g:adm:rwx w     # allow 'adm' group to read/write
sudo setfacl -d -m g:adm:rwx w  # make above default for new files/dirs

cd w
curl https://latest.mediawiki.release | tar xvf - --strip-components=1
sudo setfacl -R -m g:www-data:rwX cache images
sudo setfacl -R -d -m g:www-data:rwX cache images

And yes, I would probably verify the signatures in real life. And yes, sometimes even I wonder if it needs to be that complicated, and maybe there is something more straightforward that could be done with the ACLs. Suggestions/edits welcome, obviously.

Should I run composer with the www-data user? I mean sudo -u www-data composer update --nodev? When I run composer with root, composer says that is bad.

Having set things up as above, I would run composer as somebody in the "adm" group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.