Struggling with "Unable to write new project config files"

[adrianjean]

My Problem:

I've had this issue for a while now.
From CraftCMS 3.x — up to today in CraftCMS 5.x

My CraftCMS sites run on a no frills LAMP server with lots if resources.
I have tried almost everything I can think of in terms of file permissions while still maintaining security.

What I used to do was:

chown -R user:www-data /var/www/website.com
chmod -R g+rw /var/www/website.com

Where:

• user is a non-root user account with the ability to log into the server.
• www-data is the Apache web server group, of which both the user and Apache belong.

This gives me a fully functional CraftCMS site that can upload and delete assets, and have no issues operating otherwise. However, after a time, I would get the dreaded Unable to write new project config files error. Usually as I am making changes to field settings, or changing configuration in the CP. So I would re-run those two commands to reset the perms and boom - my CraftCMS site would come back no problem.

So in an effort to try to prevent what seems to be a permissions issue, I tried setting perms inheritance so that if CraftCMS created a file, it would hopefully inherit the perms of those around it:

chmod g+s /srv/www/website.com

.... but this doesn't help. And, after a while I'll run into the same problem.

Today, I have a multi user environment so I have to resort to ACLs to manage perms on the web root — I've even had to write a script to nuke and re-apply all the perms as this error happens so frequently. The site works, but then after a while some perms get out of sync, and the site can't write to project config.

I have seen and read this:
https://nystudio107.com/blog/hardening-craft-cms-permissions

My Question:

Those of you who run CrafCMS on LAMP servers — how do you manager your perms? Do you often have to reset the perms to keep the site maintained over time? Am I missing something or is this just the way things work?

[angrybrad]

However, after a time, I would get the dreaded Unable to write new project config files error.

So writing project config files works for a while, then after some time it stops working with that error?

When you get the error, what do the permissions and user:group ownership look like on the config/project folder?

[adrianjean]

Exactly.
Next time it happens I'll screen grab the perms and post it here.

[adrianjean]

Ok I just got the error.
Looks like there was an issue writing to the cp-nav config settings.

Unable to write new contents to "/srv/www/website.com/config/project/cp-nav/navigations/seomatic--5b9aa81a-59f4-4ec0-8c18-66052c1e4ff7.yaml".

All of the perms for each folder in this path: /website.com/config/project/cp-nav/navigations are drwxrwxr-x with www-data:www-data owner/group.

However the yaml files are: -rw-r--r-- and the owner:group: www-data www-data

Not sure if this is helpful as it seems the files are writeable by the owner.

[adrianjean]

Just got another error on another site... I'm only just noticing now that it's also related to writing CP Nav:

/config/project/cp-nav/navigations/1fe3944d-1735-4faf-9758-b419f88daf0e.yaml".

This may be a CP Nav issue — but I'll keep track of it a little longer to see if there is a pattern. If we could keep this discussion open so I can add more to it over time that would be great.

[adrianjean]

... Ok not just CP Nav. Got another error (on the same site as above, a 5.x site):

.../config/project/campaign/campaignTypes/newsletterCampaignType--ade7bbd1-4f10-4c41-8f48-6bcffe9514ce.yaml".

All similar conditions.

Sometimes waiting a few seconds and refreshing the page brings the site back.

[angrybrad]

Assuming this is for the same site/environment/server as #15351 (comment) we can look at this issue as well.

[adrianjean]

That's correct. In fact as I was working with two users live on a zoom, I was getting all sorts of perms issues writing to the project config.