Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Ubuntu server running Apache. I have a web application that writes files to a folder. Apache is running as www-data:www-data, so all the files get created using that user and group.

I also have a user shabbyrobe that I use to log in to the box and make non-root changes. If I want to change stuff that has been touched by www-data though, I'm finding myself cracking it and just doing sudo -i, then before I know it I'm doing everything at an elevated privilege level and it really does feel like I shouldn't need to be root at all.

I added shabbyrobe to the www-data group and ran chmod -R 2775 on the folder full of files written by my web application, but new files were still being created as 755, so user shabbyrobe had no access.

Basically, I'm just wondering if it's safe for me to change the umask in /etc/profile from 022 (which seems to be the default) to 002 without compromising the security of my server. I guess I'm just figuring there must be a reason why it's 022 by default, and I don't want to just blithely change it without understanding what that reason is.

Update: in response to Caleb's suggestion, I thought more about it and it doesn't feel like it would be a great idea to set the umask system wide considering it is possible to set it for apache only. So if I change the umask to 002 in /etc/apache2/envvars instead of /etc/profile, what security considerations remain?

share|improve this question
add comment

1 Answer 1

up vote 4 down vote accepted

Setting the umask to 002 would make all files created also writable by anybody in the same GROUP as the user that wrote the file.

Depending on your system configuration, this could introduce significant security issues. i would not recommend doing this system wide. If you have a particular user or program that would benefit from creating files that are writable by other users in it's group, it would be ok to set this locally to the execution of that program or script, but it would be a Bad Idea™ to make it the default behavior.

Be aware that it is particularly dangerous to allow write access to anything that can be executed by other users because a sneaky change to an executable file might get run unawares by another user and allow malicious code to be executed as their users, compromising their account.

share|improve this answer
    
OK so if I just set it for apache, it would only be applicable for anything apache does? I've done some more poking around and found that I can just add umask 002 to /etc/apache2/envvars and it will just change it for apache rather than everything else... what security considerations would remain for a public web server? –  Shabbyrobe May 18 '11 at 12:54
    
This would depend on what group apache runs as. Changes are it runs in it's own group anyway, in which case setting this value would have no effect at all and you wouldn't gain anything. If it is part of a general services group, then it would expose all files writing by apache (think untrusted uploads) to compromise by other services on the system. –  Caleb May 18 '11 at 12:57
    
It runs by default in the www-data group, to which I have added my own user shabbyrobe –  Shabbyrobe May 18 '11 at 13:01
    
Sounds safe enough to me if it's in an isolated group like that. Just be careful how you handle files that were created by apache. –  Caleb May 18 '11 at 13:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.