Recently, I read an article on the Sucuri Blog about the fundamentals of filesystem permissions, and how to apply some these fundamental concepts to securing web applications. When I noticed the article, I was quite happy to see that this issue was getting what I believed to be some much needed attention. As a security administrator working for a mid-sized web hosting company, I have found filesystem permissions to be one of the most misunderstood fundamentals of managing web applications. This misunderstanding can have colossal consequences when paired with unpatched, vulnerable web applications.
Having been the first responder to the ensuing incidents (which I assure you, are not pretty), I was hoping Sucuri’s post would be the champion of that cause which I have recently found so near and dear to my heart. While it is an excellent overview of UNIX filesystem permissions for someone who has no knowledge of such things, it stopped short of answering what, in my mind, is the real question that needs to be answered about filesystem permissions. Principally:
How do I decide what modes to apply to which filesystem resources?
With the aforementioned blog article having stopped short of answering that question, I decided to take it upon myself to build on the article, and deliver the unambiguous answer which so badly needs delivering. So without further adieu, we will explore the question.