Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have some inherited php code that I'm attempting to secure. However, removing execute permissions from the file upload directory throws a permissions error. Here's a quick rundown:

apache points to /root/www/ (only user on the system is root)

image uploads are saved to /files via symlink at /root/www/admin/files (I have no idea why files are saved to /)

Permissions:

drwxrwxrwx  8 root     root      4096 2011-04-06 16:51 root  (root home directory)
drwxr-xr-x  8 www-data www-data     4096 2011-04-01 19:34 www   (folder in /root/)
lrwxrwxrwx  1 root     root        21 2011-03-04 20:32 files -> /files/  (symlink)

 drw-------  4 www-data www-data 61440 2011-04-06 16:12 files   (folder in root directory)
-rwxrwx---  1 www-data www-data      81 2011-04-06 15:56 .htaccess (file in /files/)

Apache Error log excerpt:

[Wed Apr 06 16:58:24 2011] [crit] [client 1.2.3.4] (13)Permission denied: 
/root/www/admin/files/.htaccess pcfg_openfile: unable to check htaccess file,
ensure it is readable, referer: http://example.com



I want to change permissions on /files/ from 700 to 600. I can't figure out why .htaccess is only read-able when execute permissions are set.

share|improve this question

3 Answers 3

up vote 3 down vote accepted

I suspect your confusion here is stemming from a common misunderstanding of Unix-like file permissions, specifically: On a directory, "execute" does not mean "execute".

I suspect you are trying to ensure that files uploaded to the upload directory cannot be executed, correct? That's good common sense to do. However, your approach is flawed: On a directory, the "execute" bit doesn't mean "allow files in here to be executed", but rather "allow users to traverse this directory". In other words, removing the execute bit on a directory for a user/group/world removes the ability of the relevant users to reach any file or directory within it -- exactly what Apache is now complaining it can't do.

You need the upload directory to remain "executable". What you instead need in there is a umask to ensure that uploaded files are not executable. (Actually, even that isn't necessary, as files by default are not executable on *nix.)

share|improve this answer
    
Aha! That makes a lot more sense. It seems apache sets the umask correctly and I was confused on execute for directories. Thanks. –  Toast Apr 6 '11 at 17:33
1  
In point of fact, I don't think it's Apache setting the appropriate umask, but just the Linux default: No file is ever executable by default, you have to explicitly add that permission. (Notable exception being that files in e.g. a tarball archive can be marked executable before being added to the archive, and will still be executable when extracted, but that still requires someone to manually make the file executable.) Still, the end result is the same -- those uploaded files are not executable. Just make sure Apache can't be tricked into thinking they might be e.g. PHP files... –  Kromey Apr 6 '11 at 17:40
    
Thanks @Kromey. The .htaccess file does not allow serving php from this directory, and we also resize the images as they come in (using imagick) and use mod_rewrite for all incoming urls. We're looking at using finfo to inspect the files themselves, since MIME type is unreliable. Any other advice or sources are much appreciated. =D –  Toast Apr 6 '11 at 21:11

Although your main problem is solved, another possible solution to your problem of not allowing uploaded files to be executed would be to mount /files with noexec. This would require a new partition however.

share|improve this answer

As .htaccess lives inside /files it isn't reachable if the current user hasn't got execute permissions on /files. Try it yourself as a regular user: create a new directory, put a file inside it and then remove the directory's execute bit. You shouldn't be able to reach the file inside.

What is the rationale behind wanting to remove that particular execute bit? I see no security advantage behind that, but let me know if I'm missing something.

share|improve this answer
    
The user can upload images to their site. They are saved and served from /files. I don't want execute permissions on this directory to prevent users from uploading malicious files and having execute permissions. –  Toast Apr 6 '11 at 17:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.