Question

UI::Manage sets a new WEB directory permissions to 775 by default:

sub _createEmptyWeb {
  my ( $theWeb ) = @_;

  my $dir = "$TWiki::dataDir/$theWeb";
  umask( 0 );
  unless( mkdir( $dir, 0775 ) )

We maintain our TWiki content in an NFS mounted partition and would like to prevent prying eyes from accessing TWiki content via mechanisms other than TWiki. Are there any potential known programmatic issues if the permissions mask were changed to "770" such that only the owner:group can access the web directories? Our Apache runs as nobody:nobody

Environment

-- SteveRJones - 23 Jan 2006

Answer

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.

I think that should be OK as long as nobody is in the group. It might be sufficient though to lock down just one of the parent directories with a 775, such as the twiki directory.

-- PeterThoeny - 24 Jan 2006

The lockdown would have to occur at some level that would protect an entire directory tree, for example the /data tree. Problems occur if one does not lock down directories under /pub as this is where attachments go and people have a knack for putting attachments where they do not belong.

Which leads me to another question: The permissions are hardcoded in UI:Manage and I suspect in other places (like the FlowChartPlugin when it creates a dir in /pub). It would seem to me that perhaps the mkdir Perl function needs to be (I can't remember the OO term) "wrapped" such that when used within Twiki it will honor a configurable permissions setting. I hate hacking apart code to achieve this kind of an end state.

Thoughts?

-- SteveRJones - 25 Jan 2006