Make native filesystem directory permissions configurable to support shared POSIX ACL access
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
从 src/Filesystem/AbstractAdapter.php::makeDirectory() 开始，那里硬编码了 0755 模式；以及 src/Providers/ViewServiceProvider.php::boot()，它在启动期间触发 storage/statamic/tmp/nocache 目录的创建。在 config/statamic/system.php 中添加一个默认值为 0755 的 directory_permissions 设置，并在 makeDirectory 传入模式的位置读取它，不要改动静态页面写入器的配置，也不要对已存在的目录执行 chmod。完成的标准是：配置的 0775/0770 被用于新建目录（由一个针对原生适配器的测试覆盖），同时默认行为保持不变。
由索引模型根据 Issue 内容生成。
描述
Bug description
Statamic’s native filesystem adapter creates directories with a hardcoded 0755 mode. On Linux deployments where CLI and web processes use different Unix accounts and share write access through POSIX ACLs, this restricts the inherited access ACL mask to r-x.
The named user entries are inherited, but their effective write permission is removed. This can prevent Blade nocache fragments from being written:
file_put_contents(.../storage/statamic/tmp/nocache/_nocache….blade.php):
Failed to open stream: Permission denied
The permission mechanism was reproduced locally using Statamic’s native filesystem adapter.
Relevant code
ViewServiceProvider::boot()(https://github.com/statamic/cms/blob/v6.34.1/src/Providers/ViewServiceProvider.php) createsstorage/statamic/tmp/nocacheduring application boot, including CLI boot.AbstractAdapter::makeDirectory()(https://github.com/statamic/cms/blob/v6.34.1/src/Filesystem/AbstractAdapter.php) delegates to Laravel’s filesystem with mode0755, recursive creation enabled.CompilesNocache::compileNocache()(https://github.com/statamic/cms/blob/v6.34.1/src/View/Blade/Concerns/CompilesNocache.php) writes fragments throughStatamic\Facades\File.
This path uses the native filesystem adapter, so Laravel disk permissions configured in config/filesystems.php do not affect it. The static page writer’s configurable permissions also do not cover these temporary Blade views.
Reproduction
Proposed change
Expose the native filesystem directory creation mode through configuration, preserving 0755 as the default for backwards compatibility.
For example, introduce a setting in config/statamic/system.php:
'directory_permissions' => 0755,
The native adapter would use that configured mode instead of the hardcoded value. Deployments using shared group or ACL access could choose 0775 or 0770.
This should affect newly created directories only, without recursively changing existing permissions or altering the separate static page writer configuration.
Expected behavior
With a configured mode of 0775 or 0770, inherited ACL write permissions remain effective for the other account, allowing CLI and web processes to share Statamic’s temporary directories.
Changing the process umask alone cannot solve this: it cannot add the group-class write bit missing from the explicitly requested 0755 mode.
How to reproduce
In a disposable application checkout:
- Use different Unix accounts for CLI commands and web requests.
- Grant both accounts write access to
storage/statamicthrough access and default ACLs, with a default mask ofrwx. - Start with
storage/statamic/tmp/nocacheabsent. - Boot the application through a CLI command.
- Render a Blade template containing a nocache region through the web account.
Directories created by the CLI account inherit ACLs like:
user::rwx
user:web_account:rwx #effective:r-x
group::rwx #effective:r-x
mask::r-x
default:user:web_account:rwx
default:mask::rwx
The web account cannot create the fragment. The directory owner retains write access; the failure affects the other account accessing it through the masked ACL entries.
Restoring the access mask allows writing again:
setfacl -R -m m::rwX storage/statamic/tmp
Logs
Environment
- Statamic: 6.34.1
- Laravel: 12.69.3
Installation
Fresh statamic/statamic site via CLI
Additional details
No response
- 主要语言
- PHP
- 星标
- 4.9k
- 派生
- 647
- 平均合并
- 1 天 20 小时
- 30 天内合并 PR
- 113
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
statamic/cms 的其他 Issue
-
preferences
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
accessibility
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
[7.x] Reintroduce parser error for mixed pipe/shorthand modifier syntax可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭antlers
难度 2/5 1-3 小时 新手友好度 66/100
维护者通常 1 天内回复
-
navigations
难度 3/5 1-2 天 新手友好度 68/100
维护者通常 1 天内回复
-
utilities
难度 4/5 3-5 天 新手友好度 35/100
statamic/cms#15623 · 2 个 reaction ·
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 70/100
-
WhatsApp link preview crawler is not detected as a bot可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
matomo-org/device-detector#8405 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 66/100
维护者通常 1 天内回复
-
sync-en
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 1 天内回复
-
sync-en
难度 2/5 1-3 小时 新手友好度 66/100
维护者通常 4 天内回复