Answers.Body: <p>We ran into this issue as well and our cron was:</p>
  
  <p>*/1 * * * *  username cd $CIVI_ROOT; $PHP bin/cli.php $PARAMS</p>
  
  <p>If I change username to www-data the cron seems to run and send the email with attachment, but I am concerned whether there could be file permission issues if the cron is also trying to write to folders under /home/username that it won't have permission to if run as www-data?</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-10-09T10:52:50.437Z
Answers.LastActivityDate: 2015-10-09T10:52:50.437Z
Answers.UserDisplayName: Andrew
Answers.Body: <p><strong>CiviCRM tasks (including CiviCRM cron) should be run as your www user.</strong></p>
  
  <p>It's possible to run CiviCRM tasks as multiple users, but you will have to handle filesystem permissions yourself. Avoid this if you can; it's unlikely to be easier than just running cron under the <em>www</em> user account.</p>
  
  <p>If you're configuring cron as a system job, you can include the username of the user to run the job as:</p>
  
  <pre><code>#mm hh  day mon wkday user      command
  */4 *   *   *   *     www-data  drush @example.org job.execute -u 1 --out=json | logger -t "civicrm[@example.org]"
  </code></pre>
  
  <p>CiviCRM filesystem permissions issues are also discussed in <a href="https://civicrm.stackexchange.com/questions/2923/civicrm-does-not-have-permission-to-write-temp-files">CiviCRM does not have permission to write temp files</a> - the same issue affects CiviCRM when called from CLI such as <code>wp-cli</code> or <code>drush</code>.</p>
  
  <p>Note that <em>"www user"</em> may vary on different configurations - it may be <code>www-data</code>, <code>nobody</code>, or some other user account. It's the same user as the one which owns the files in your <code>templates_c/</code> directory.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-10-11T20:23:02.907Z
Answers.LastActivityDate: 2015-10-11T22:07:21.307Z
Answers.LastEditDate: 2017-04-13T12:53:13.207Z
Answers.UserDisplayName: Chris Burgess
Answers.Body: <p>It's seems like a bug to me. I can reproduced it on at least one of my site.
  The permission used to be 660 and is now 600 with the new angular CiviMail.</p>
  
  <p>Can you log an issue in <a href="https://issues.civicrm.org/jira" rel="nofollow">JIRA</a> ?</p>
  
  <p>In the mean time, I think it's possible to use legacy UI instead of Angular but can't find how :(</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>In my case, i am able to make it work when running the task manually because it's then run as www-data. But it doesn't work when the process is run by cron.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-24T20:25:13.033Z
Answers.Text: Is cron not running for your site as user www-data?
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-25T18:48:01.373Z
Answers.Text: No we use Aegir with drush, and cron is then called as user aegir.
Answers.UserDisplayName: samuelsov
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-19T22:12:44.373Z
Answers.Text: Aegir config shares a group between users `aegir` and `www-data` to permit cron running as aegir ... If CiviCRM indeed sets permissions to `600` / `go-rwx`, this will prevent the intended functionality sharing access between the two. This should be reported as an issue in JIRA if it's the case.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-24T14:37:46.523Z
Answers.LastActivityDate: 2015-09-24T14:47:50.943Z
Answers.LastEditDate: 2015-09-24T14:47:50.943Z
Answers.UserDisplayName: samuelsov
Answers.Body: <p>I suspect that this issue has been fixed in CiviCRM 4.7:<br>
  <a href="https://issues.civicrm.org/jira/browse/CRM-17432" rel="nofollow">https://issues.civicrm.org/jira/browse/CRM-17432</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-10-12T12:55:39.030Z
Answers.LastActivityDate: 2016-10-12T12:55:39.030Z
Answers.UserDisplayName: bgm
Body: <p>i have an outbound email that keeps failing with a file permission error.  civi created the file with (600 running as nobody) and the cronjob (running as the account owner) can't access that file.</p>
  
  <p>i think this is new behaviour as the user reports that emails with attachments worked before our latest upgrade (458->468)</p>
  
  <p>anyway can i force civi to create attachments with (666)  ? this allows the cron user to access the file  (which i tested by resending the email -- changing the permission on the attachment manually -- and then scheduling for immediate send) </p>
  
  <p>(and yes i know it's "bad practice" to attach files to bulk emails -- but this is a valid use case.  user is sending audition packets to potential members of one of our performing ensembles.  only 58 recipients.  which BTW is a good reason the hard-limit on direct emails to contacts should be a user-adjustable setting not a hard-coded value in a core file! ) </p>
  
Tags: <civimail>
Title: file permission issue -- file attachment in mass mail
ThreadText: # file permission issue -- file attachment in mass mail
  
  (Asked by: username_0 on 2015-09-23)
  
  i have an outbound email that keeps failing with a file permission error. civi created the file with (600 running as nobody) and the cronjob (running as the account owner) can't access that file.
  
  i think this is new behaviour as the user reports that emails with attachments worked before our latest upgrade (458->468)
  
  anyway can i force civi to create attachments with (666) ? this allows the cron user to access the file (which i tested by resending the email -- changing the permission on the attachment manually -- and then scheduling for immediate send)
  
  (and yes i know it's "bad practice" to attach files to bulk emails -- but this is a valid use case. user is sending audition packets to potential members of one of our performing ensembles. only 58 recipients. which BTW is a good reason the hard-limit on direct emails to contacts should be a user-adjustable setting not a hard-coded value in a core file! )
  
  **Tags:** civimail
  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_1 on 2015-10-09. Score: 1
  
  We ran into this issue as well and our cron was:
  
  \*/1 \* \* \* \* username cd $CIVI\_ROOT; $PHP bin/cli.php $PARAMS
  
  If I change username to www-data the cron seems to run and send the email with attachment, but I am concerned whether there could be file permission issues if the cron is also trying to write to folders under /home/username that it won't have permission to if run as www-data?
  
  
  ---
  
  ### Answer by username_2 on 2015-10-11. Score: 1
  
  CiviCRM tasks (including CiviCRM cron) should be run as your www user.
  It's possible to run CiviCRM tasks as multiple users, but you will have to handle filesystem permissions yourself. Avoid this if you can; it's unlikely to be easier than just running cron under the www user account.
  If you're configuring cron as a system job, you can include the username of the user to run the job as:
  #mm hh  day mon wkday user      command
  */4 *   *   *   *     www-data  drush @example.org job.execute -u 1 --out=json | logger -t "civicrm[@example.org]"
  
  CiviCRM filesystem permissions issues are also discussed in CiviCRM does not have permission to write temp files - the same issue affects CiviCRM when called from CLI such as wp-cli or drush.
  Note that "www user" may vary on different configurations - it may be www-data, nobody, or some other user account. It's the same user as the one which owns the files in your templates_c/ directory.
  
  
  ---
  
  ### Answer by username_3 on 2015-09-24. Score: 1
  
  It's seems like a bug to me. I can reproduced it on at least one of my site.
  The permission used to be 660 and is now 600 with the new angular CiviMail.
  
  Can you log an issue in [JIRA](https://issues.civicrm.org/jira) ?
  
  In the mean time, I think it's possible to use legacy UI instead of Angular but can't find how :(
  
  **EDIT**
  
  In my case, i am able to make it work when running the task manually because it's then run as www-data. But it doesn't work when the process is run by cron.
  
  > **Comments:**
  > **username_4**: Is cron not running for your site as user www-data?  
  > **username_3**: No we use Aegir with drush, and cron is then called as user aegir.  
  > **username_2**: Aegir config shares a group between users `aegir` and `www-data` to permit cron running as aegir ... If CiviCRM indeed sets permissions to `600` / `go-rwx`, this will prevent the intended functionality sharing access between the two. This should be reported as an issue in JIRA if it's the case.  
  
  ---
  
  ### Answer by username_5 on 2016-10-12. Score: 1
  
  I suspect that this issue has been fixed in CiviCRM 4.7:  
  <https://issues.civicrm.org/jira/browse/CRM-17432>
  
  
  ---
  
  