Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PHP has write access to entire web root #368

Open
culturedsys opened this issue Sep 30, 2015 · 2 comments
Open

PHP has write access to entire web root #368

culturedsys opened this issue Sep 30, 2015 · 2 comments
Labels

Comments

@culturedsys
Copy link

Currently, PHP-FPM is set up to run as web_user, which is the same user that owns the files in the web root. This means that PHP code can modify any file in the web root. This is a potential security problem, because it means that, if there is a vulnerability in WordPress or a plugin, that can be used to make long-lasting changes, such as inserting a backdoor or serving spam. The recommended configuration is to have the PHP process run as a different user from the user that owns the files, and specifically enable PHP to write only to those places it actually needs to, i.e., the uploads folder. See e.g: http://codex.wordpress.org/Hardening_WordPress#File_Permissions

This bug was introduced in response to #174 , in order to allow WordPress to write to the uploads directory. A better solution, I think, would be to change the permissions on the uploads directory only to allow the www-data group to write only to that directory, and not to the rest of the web root.

@jameskraus
Copy link
Contributor

A lot of plugins require write access to the web root to get full functionality. e.g. symlinking a db.php in place for query-monitor or W3TC. This might not work well for the majority of users.

@perifer
Copy link
Contributor

perifer commented Oct 4, 2016

Could it be an alternative to let security concerned users of Trellis opt out of having the web root owned by the same user that runs the PHP process?

@roots roots deleted a comment from roots-ladybug Feb 3, 2018
@swalkinshaw swalkinshaw reopened this Feb 3, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

5 participants