Cache directory permission errors after app installation

Question

Cache directory permission errors after app installation

When installing applications on Yunohost v4.x, the system creates per-app cache directories under /var/cache/yunohost/ with ownership and permission settings that must align with the application's runtime requirements. The documented behavior shows that cache invalidation occurs during package updates, but certain applications may skip proper cache headers, potentially leaving stale data accessible.

System logs indicate 'Cache directory not writable' errors when nginx worker processes lack proper permissions to access the cache directory. This suggests a potential misalignment between the cache directory permissions set during installation and the runtime requirements of specific applications.

The Yunohost web admin interface displays 'Cache Error' when php-fpm fails to clear opcache after app upgrades, indicating that cache-related issues can manifest in multiple ways across different system components.

Which permission model should be applied to ensure cache directories remain accessible to both nginx worker processes and php-fpm during application lifecycle operations, and how can this be verified across different application types?

Tasadduq Burney · Answer

Answer the exact question first
Use a shared group (typically www-data) for all per‑app cache directories, apply the set‑gid bit on the parent /var/cache/yunohost, and set the directory mode to 775. This guarantees that both the nginx worker processes (running as www-data) and the php‑fpm pool (running as the app’s dedicated user) can read and write cache files without permission errors.
Why this model works

Shared group – nginx and php‑fpm can share write access via the group.
Set‑gid on parent – any new sub‑directory inherits the group automatically, preventing manual intervention for each app.
Mode 775 – grants read/write/execute to owner and group, while restricting others.

Steps for your case

Ensure the parent directory has the correct group and set‑gid:
# chown root:www-data /var/cache/yunohost
# chmod 2775 /var/cache/yunohost

For each existing app cache directory, apply the same ownership and mode:
# chown appuser:www-data /var/cache/yunohost/appname
# chmod 775 /var/cache/yunohost/appname

Clear any stale cache to avoid permission‑related corruption:
# rm -rf /var/cache/yunohost/appname/*

Restart services so the new permissions take effect:
# systemctl restart nginx
# systemctl restart php-fpm

Verification

Check ownership and mode:
# stat -c '%U %G %a' /var/cache/yunohost/appname
# Expected output: appuser www-data 775

Run a quick PHP test. Place a file test_write.php in the app’s public directory:
<?php
$path = '/var/cache/yunohost/appname/test.txt';
file_put_contents($path, "test
", FILE_APPEND);
echo file_exists($path) ? 'write ok' : 'write failed';
?>

Access it via a browser and confirm the message “write ok”.

Check logs for any “Cache directory not writable” entries after the restart. They should no longer appear.

Optional fine‑grained control
If you need stricter ACLs, you can set a default ACL for the app directory:
# setfacl -d -m g:www-data:rwx /var/cache/yunohost/appname

New files and sub‑directories will inherit these permissions automatically.
Missing diagnostic detail
Does the application run under a user other than the default appuser? If so, that user must be added to the www-data group (or you should adjust the group accordingly). Please confirm the runtime user for the app if the above steps do not resolve the issue.

Cache directory permission errors after app installation