如何解决shell_exec读取Linux其他用户Home目录文件的权限拒绝问题？

核心问题分析 #

Linux权限体系中，**目录的执行权限（x）**是允许用户遍历进入目录的前提，仅设置文件本身的读取权限不足以让www-data访问到steam家目录下的深层文件——父目录链的权限必须同时满足。

分步解决方法 #

方法1：开放目录遍历权限+文件读取权限 #

逐一为日志文件的所有父目录添加其他用户的执行权限，再给日志文件添加读取权限：

# 依次设置各父目录的执行权限（允许www-data进入）
sudo chmod o+x /home/steam
sudo chmod o+x /home/steam/.local
sudo chmod o+x /home/steam/.local/share
sudo chmod o+x /home/steam/.local/share/Steam
sudo chmod o+x /home/steam/.local/share/Steam/steamcmd
sudo chmod o+x /home/steam/.local/share/Steam/steamcmd/7dtd
sudo chmod o+x /home/steam/.local/share/Steam/steamcmd/7dtd/7DaysToDieServer_Data

# 设置日志文件的读取权限
sudo chmod o+r /home/steam/.local/share/Steam/steamcmd/7dtd/7DaysToDieServer_Data/output_log__2024-02-13__08-54-45.txt

方法2：更安全的组权限方案（推荐） #

将www-data加入steam用户组，通过组权限控制访问，避免开放全局权限：

# 将www-data添加到steam用户组
sudo usermod -aG steam www-data

# 重启Apache让组权限生效
sudo systemctl restart apache2

# 设置父目录的组执行权限
sudo chmod g+x /home/steam /home/steam/.local /home/steam/.local/share /home/steam/.local/share/Steam /home/steam/.local/share/Steam/steamcmd /home/steam/.local/share/Steam/steamcmd/7dtd /home/steam/.local/share/Steam/steamcmd/7dtd/7DaysToDieServer_Data

# 设置日志文件的组读取权限
sudo chmod g+r /home/steam/.local/share/Steam/steamcmd/7dtd/7DaysToDieServer_Data/output_log__2024-02-13__08-54-45.txt

方法3：适配自动生成的日志文件 #

如果日志文件会被程序自动生成，可设置目录的setgid位，让新文件自动继承目录的组权限：

sudo chmod g+s /home/steam/.local/share/Steam/steamcmd/7dtd/7DaysToDieServer_Data

验证权限是否生效 #

切换到www-data用户测试读取，确认权限配置成功：

sudo -u www-data cat /home/steam/.local/share/Steam/steamcmd/7dtd/7DaysToDieServer_Data/output_log__2024-02-13__08-54-45.txt

若能正常输出日志内容，说明权限设置完成，server_log.php的shell_exec即可正常执行。

内容的提问来源于stack exchange，提问作者user3789797