Ownership/permissions of uploaded files

Question

I want to find out if I am on the right track.

My upload script that does the following:

• Check if the extension is gif, png, jpg org jpeg
• Check if mime is image/jpeg, image/png, image/gif
• Check if a valid file was uploaded
• Upload file to /images
• .htaccess script in the /images that disables script Execution

After that I have set the following permissions for /images

• owner/group = www-data
• Permissions = 700

Question:

• Does the last step where I set the permissions on /images make sense?

This is part of an e-commerce solution. The images that are uploaded while be shown on products, product lists etc. That means the visitors should have permisson the view the images.

I run apache 2.2 under the user www-data

Answer 1

Your setup will prevent any other user on the local system (aside from root) from doing anything with these files. This is sound enough, so long as no other service running under different privileges needs access. It depends what you plan to do with the images once they're uploaded.

However, this will not prevent someone with access to the site from uploading files. The apache service is running as www-data, so any file written to the disk by apache will be owned by that user.

If a hacker somehow bypasses your protection measures and gains access to the uploader, they will be able to upload files. The underlying filesystem has no way of knowing whether the files are coming from an authorised http user.

Edit

If I understand you correctly, your main concern is that someone compromises your upload script, uploads a new script file and executes by accessing it through your main site?

It's a sound idea to set the minimal necessary permissions on areas containing uploaded files. Your web application will also be running as www-data, I assume, so it will be able to display images to your end users.

However, it should be clear that preventing script execution in the way you desire is not a job for the file system. The execute bit is not relevant and the focus should be on ensuring your app is safe as well as taking the apache configuration measures you've listed.

Answer 2

No, you shouldn't need to set them, unless the 'upload script' write files with default permissions that are not readable by the www-data user or the file is explicitly wrote to a directory that is 'executable' with the execute bit enabled.

Answer 3

This makes no sense, your unprivileged webserver userid should not own any of the content it serves, and should not be able to write to any files it serves, which your doin gboth explicitly.