0

I'm on Mac OSX and i I have apache2 installed via MacPorts, running as the _www user.

I have some files I want to serve in the /Users/Me/Documents/abc folder.

Right now, though, the permissions of /Users/Me/Documents are 700. So, _www can't get in, even if abc is chmod 777.

I recognize the following options:

  1. Allow _www access to my Documents folder.
  2. Put the files I want to share outside of my Documents folder.
  3. Hard-link the files outside of my Documents folder, and point apache to the hard links.

None of these solutions are acceptable to me, however. I don't feel safe allowing _www access to my entire Documents folder. I really want to keep the files in my Documents folder for other reasons. The files are changing all the time, so hard-linking would not always reflect the right file structure, and, as I understand it, you can't hard-link a directory (though, if you could, that would solve it).

Any ideas for a solution? Is there a way to run a few httpd processes as my user account so it can get in there?

Or, is there some way to hard-link a directory, or some way to get httpd to follow a symlink past a directory that is 700 not owned by _www?

Thanks!

Improve this question

1 Answer 1

Reset to default
3

1) Why not move your abc folder to somewhere public, and symlink it in your documents folder (and/or webfolder) if you want to be able to get to them there?

2) Another option would be to just set 701 on your document folder: listing is all that is required to get through.

3) Of course you can run an apache process / thread as 'you' (either as a seperate server config or by leveraging suexec), but that would hardly be advisable if the whole problem begins with the fact you don't want apache to have access to your other files...

Improve this answer
3
  • Why set the permissions to 701 and not 711?
    – Trey Hunner
    Jun 5, 2010 at 19:13
  • 701 would give world execute privilege to that directory and would allow it to descend. Setting the group privilege probably won't make any difference since the user's groupid is not the same as the webserver's groupid. 701 is more correct, 711 would also work.
    – user6738237482
    Jun 5, 2010 at 19:19
  • 1
    Indeed, not giving group permissions but 'all' permissions serves as kind of a reminder when things change that no group needs access, so if 'all' is no longer necessary you'd naturally go back to 700 instead of 710. Then again, there is something to say for creating a group with _www (and possibly you) and setting 710 instead, so the listing is only available to you & the webserver and not other processes / users.
    – Wrikken
    Jun 5, 2010 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .