3

In Magento 2 we have a new filesystem permissions guidelines.

Reading this link I understand that Magento requires php user inside www-data group.

What I do not understand is why static filesystem permissions are generated using 0770 instead of 0750.

With this kind of permissions another user in the same server and belonging to www-data group will be able to modify all my files.

Isn't it dangerous? Is there any reason for this?

I know the Magento 2 approach is to always have a dedicated VM and I agree with it, but I do not see any good reason for this permissions settings.

closed as off-topic by Anna Völkl, Qaisar Satti, Raphael at Digital Pianism, Keyul Shah, Sander Mangel Apr 13 '16 at 9:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced OR seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Anna Völkl, Qaisar Satti, Raphael at Digital Pianism, Keyul Shah, Sander Mangel
If this question can be reworded to fit the rules in the help center, please edit the question.

  • We recommend 750 permissions in production mode, where you want security locked down. In development, when you're presumably inside a firewall with no outside access, it might not be necessary. – Steve Johnson Feb 25 '16 at 23:36
  • I've seen this is hardcoded in the Magento core, what I'm asking is the reason. I think there should be one. – Phoenix128_RiccardoT Feb 26 '16 at 12:04
  • Security. We have had multiple attacks where malicious code was written to a directory, either the root or pub. It's harder to carry out an attack if files aren't writeable or executable. Magento hard-codes permissions for both developer and production modes; AFAIK, default is the same as developer. – Steve Johnson Feb 28 '16 at 1:25
  • So why 770 instead of 750? – Phoenix128_RiccardoT Feb 28 '16 at 14:14
  • 1
    Depends on the mode you're in. – Steve Johnson Feb 28 '16 at 15:06