0

We want a better approach to filesystem permissions. I find no existing question that fully addresses this issue to my satisfaction. As background, I have consulted the usual references, including:

The context is a Magento 2.3.3 store running on a dedicated (not shared) host. We have full root access and can create any users, groups and permissions needed. We also have a filesystem that supports ACL's.

Our team does not feel that the standard Magento recommendations meet our requirements.

One change which we consider an improvement is that the user account of the webserver (user apache in our case) does not have ownership of most files under the webroot. Giving apache ownership enables apache to write to directories and this opens the server up to exploits in our opinion.

Our current approach has these users/groups:

  • Our webserver runs as user and group apache
  • We created a restricted user (and group) named webuser
  • We created a group webdev which all developers are members of
  • Most files under the webroot are owned by webuser:webdev
  • Most files under the webroot have Magento's recommended permissions of 644
  • Most directories the webroot have Magento's recommended permissions of 755
  • the setgid bit on directories is set as recommended.
  • the folders under webroot "var" "generated" "pub/static" "pub/media" "app/etc" are an exception because they have apache as owner

Here's an example of how we currently run Magento commands:

sudo -u apache /bin/php -dmemory_limit=-1 bin/magento setup:di:compile

How can we do better that the file permissions above? In particular, how can we remove all permissions for "other" from files and all but "x" from directories?

Some of the documents I listed suggest various schemes. In particular, see "You can have your cake and eat it too" at https://serverfault.com/a/357109

That answer suggests restricting the owner more than the group. This approach interests us. We would probably just use it directly if we were not running Magento. However, that approach seems to raise issues specific to Magento development. Some Magento commands create files or make other changes to the filesystem. For example:

  • bin/magento setup:di:compile
  • bin/magento setup:static-content:deploy -f -s standard
  • bin/magento indexer:reindex
  • bin/magento setup:upgrade

If commands like those are run as root, the resulting file permissions are not secure. The commands need to be run as a user who can write to Magento folders under webroot, which is why we run them as apache currently.

If we follow the advice in "You can have your cake and eat it too", the chmod commands would be something like this:

find "$webroot" -type f -exec chmod 0460 {} + &&
find "$webroot" -type d -exec chmod 6571 {} +

However, that appears to prevent running Magento commands as a non-root user (given our current users and groups). Our Magento site is under active development and we need to run these kind of commands frequently. But we still want to maintain the best file permissions possible.

One other approach might be to run Magento commands as root and then run a script that checks and resets all file permissions under the webroot. Unfortunately, the extra step of fixing permissions is something developers may forget to run at times. I would like to come up with a better approach and that's the motivation for this question. I am seeking deeply thought-out answers, not quick responses aimed at noobies who we are simply trying to convince not to use "777". Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.