On 5/18/07, Al <news@xxxxxxxxxxxxx> wrote:
I'm on a shared Linux host and have been wondering about security and
directory "other" ["world"] permissions.
The defaults are 755. The 'others' [world] can read them only.
Is there a security hole if a dir on the doc root if a directory has
permissions 757?
If there is a security problem, what is it?
Thanks...
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
DISCLAIMER: Bare with me.... this is a bit of a long answer.... enjoy!
I can't think of any good reason why you'd have 757 for your
permissions, first of all.
Secondly, yes, there are security holes in having world-writable
directories on a shared system. Some scripts require that you have these
permissions set, and this is primarily for uploading files. However, better
care should be taken by the authors to work around the 777-required
permissions. For example, if uploading an image on the web to a
web-accessible directory, it could instead be done as follows:
Set permissions on [directory] to 777.
Run script createdir.php via the web:
<?
mkdir($dir_name);
chmod($dir_name,0700);
?>
Set permissions on [directory] back to the original permissions
(probably 750 or 755).
The above example does the following:
1.) Sets the directory to allow everyone to read, write, and
execute.
2.) Apache creates a directory and sets permissions so that only it
can read, write, and execute what's in there.
3.) Sets the directory back to the original (hopefully secure)
permissions.
That means that you won't be able to add, remove, or modify anything in
that directory, of course, including the directory itself, unless you do so
via the web. For example, you won't be able to use FTP to upload to that
directory, nor can you delete anything from there via FTP or SSH (unless
your host has REALLY screwed something up).
Of course, if php_suexec is running, or if you set the SUID on the
script, then the scripts will execute as the user they belong to, not as
apache/nobody/daemon or whatever Apache is set to run as. This means that
the above paragraph does not apply, and even via Apache, it would be as
though you had manually placed the files there. This is the most-secure
operation as far as that goes, but can lead to problems of privilege
escalation if someone is able to create files under the UID of a different
user on the system and have suexec run the files.
And a basic refresher on Unix permissions as a whole (these NEVER apply
to root, who can do anything, anytime, anywhere):
Specialty User Group Everyone
# # # #
Everyone knows the basics of chmod:
- 7 5 5
`chmod 755 script.php`
-rwxr-xr-x script.php
- Owner can read, write, and execute
- Members of primary group can read and execute (can't
write to file)
- Everyone else can read and execute (can't write to
file)
Another example:
`chmod 640 script.php`
-rw-r----- script.php
- Owner can read and write (can't execute file)
- Members of primary group can read (can't write or
execute file)
- No one else (again, beside root) can read, write,
or execute file
Each bit is comprised of a math formula with values as follows:
4 - Read
2 - Write
1 - Execute
0 - No permissions (cannot be added to above numbers in permission
bit, of course)
So to get the number for the permission bit, simply add the above
numbers together to get the sum. For example, if you want the owner of the
file to be able read, write, and execute, the group to be able to read and
execute, and the rest of the world to only be able to read, you'd do
calculate the following:
Owner (read, write, execute): 4 + 2 + 1 = 7
Group (read and execute): 4 + 1 = 5
Everyone (read only): 2
Your permissions as above would be 752 (`chmod 752 script.php`).
Now, on to the 4-digit permission values you've probably seen elsewhere
begin with what's called a 'specialty bit' which allows the owner (or root)
to enforce one of the following:
4 - SUID (if executed, runs as owner, with owner permissions)
2 - GUID (if executed, runs as group, with group permissions)
1 - Sticky (if directory, only user can modify/rename/delete files
within; if file, on only *nix systems, keep file in RAM upon delete)
Using the same concept and convention as above with the math, you can
create single or combination permissions on the specialty bit of the
permissions. Some examples:
4755 - Owner can read/write/execute; group and everyone else can
read/execute; when run, runs with owner permissions
2751 - Owner can read/write/execute; group can read/execute;
everyone else can execute; runs with group permissions
6750 - Owner can read/write/execute; group can read/execute; nobody
else has permission; runs user/group permissions.
And the file permissions will look like so:
`chmod 4755 script.php` --- -rwsr-xr-x script.php
`chmod 2751 script.php` --- -rwxr-s--x script.php
`chmod 6750 script.php` --- -rwsrws--- script.php
So it's a bit longer than what you asked for, but sometimes it's good to
go over the fundamentals again. Plus, I'm not positive, but PHP may require
that you use 4-digit permissions as opposed to the common 3-digit
permissions when using the chmod() function in your scripts. Just something
to think about.
Hope it helps someone.
--
Daniel P. Brown
[office] (570-) 587-7080 Ext. 272
[mobile] (570-) 766-8107
