Skip to content

Lock down security issues regarding chmod/chown/setuid.

Hugo Leisink requested to merge BuGlessRB:securitylockdown into master

Created by: BuGlessRB

IMO, a daemon (webserver) should not be chowning/chmoding/mkdiring in general. That should be reserved for installation scripts or administrators which lock down permissions for directories and files. If files need to be created, it needs to be done using the real uid/gid from the process. Anything else would be confusing (and therefore opens the door to security leaks) to seasoned UNIX administrators.

Merge request reports