2

Well this could be a very wide question as every project have different philosophies. But meanwhile question is that We have lot of projects like Yii, Drupal, Apigility which requires full write permission on code folders itself ( I think for generating code from web browser page ) .

This could be great feature but still this is also a great security issue for give your whole (or some part of) code to world/apache writable permission. Most of time their argument is that code is generated on dev machines, while during production deployment, code will have actual permissions.

But still it have lot of security issues. Dev machine with world writable code. Also big chances are some of writable are also deployed on production too. Again most of programmers (I met) do not about care file permissions. They are very ready to give 777 if any permission issue block their path.

So If enterprise/industry level applications/projects show same attitude for requiring apache write permission on whole code folders, Then how developer attitude for file system security can be improved.

Practical scenario is that One colleague of me tell me about Apigility require permission to folders So he want what solution I propose to fix. I tell him it is bad practice to give world writable permission ( In this case ZF2 whole module folder ). And their should be any alternative path by apigility itself. But when I searched on Apigility page/forums, They promote to give write permission to module and config folders.

If I am going paranoid about all this and file system security do not impact by this ?

  • 1
    Perhaps they include auto-update or a can install modules. Those features obviously require write access to code, since essentially the project is acting as a packet manager. – CodesInChaos Sep 24 '15 at 7:30
  • @CodesInChaos, But that can be handled by shell tools like many language provide. Even if UI is needed, then it should be in more secure way than currently does. One example like generate script file from UI and run script from command line ? – kuldeep.kamboj Sep 24 '15 at 8:00
  • @CodesInChaos, I remember Symfony 1 have a command for fix permissions. Even if this projects give option like fix-permissions after running write tasks, That make them more reasonable in security terms. – kuldeep.kamboj Sep 24 '15 at 8:02
  • With many web hosting environments, shells are not always available, so most projects will cater to the lowest common denominator in lieu of making it safer by default. I agree that required file permissions and optional permissions should be well documented. Drupal actually checks permissions on some folders to make sure they're appropriate, and will disable features if they're too lax. – GuitarPicker Sep 24 '15 at 13:09