0

In order to get the Apache in Mac OS X Lion to work with symlinks, I had to follow the instructions on this page: https://discussions.apple.com/thread/1771399?threadID=1771399

One of the things I have to do is execute

chmod a+rx ~/Documents

The resulting permission of my Documents folder looks like this:

drwxr-xr-x+ 27 enchilada  staff    918 13 apr 11:36 Documents

This works fine. Now Apache can properly follow symlinks. However, my question is: Does this pose any serious security hazards that I should know about?

1 Answer 1

3

It will allow any user account on your system to enter the given directory and list its contents, including other users of your Mac, including the Guest account, if activated.

It will not affect your files through data modification or destruction, and by itself does not give permissions to read the files. But since default file access permissions allow reading everything and entering directories for all users unless you specifically prevent it, they can be read and copied. (That's also good to know for new top-level directories in ~, they're accessible to everyone on OS X by default!)

Some programs use special unprivileged user accounts as a security measure. By doing this, you'll probably circumvent the protection inherent in this.

Unless you hit buggy software (which for desktop and laptop computers is far more likely to be user software running under your user) or share much of your home directory or file system through other means, it won't be a real issue.


Regarding those instructions, they're probably too permissive.

It should suffice to make all directories on the path to e.g. ~/Documents/test executable. That's why you can enter other users' home directories; otherwise you wouldn't get to ~/Sites or ~/Public.

Just run chmod a+x ~/Documents (any user can enter the directory) and chmod a+rx ~/Documents/test (other all users can enter and read the actual directory you want to make accessible via Apache) and see whether that works.

9
  • 1
    Actually, changing user or group to the one used by the Apache server process and assigning appropriate rights would be consequent. Also, IIRC, a+rx on a directory should give any user the right to change into that directory (x), not the subdirs, and to read the list of files (r) of that directory, not the contents of the contained files. (That the files might have read rights set and reading them might(?) be prevented by not setting x on the dir is another story)
    – zpea
    Apr 22, 2012 at 16:19
  • 1
    @zpea Right, I saw a -R where none was. Will adjust my answer. Thanks!
    – Daniel Beck
    Apr 22, 2012 at 16:26
  • 1
    @Enchilada Try using ACLs. Run sudo -u _www ls /Users/username/Documents to see an error message, since _www is not allowed to list /Users/username/Documents. Run chmod +a "_www allow list,search" ~/Documents and try again. Repeat as needed. ls -e will show these ACLs, man chmod contains a more thorough explanation and examples.
    – Daniel Beck
    Apr 23, 2012 at 12:19
  • 1
    @Enchilada Those posts make the _www internal system account the owner of the files and folders in question. You wouldn't be able to access or write to your Documents folder anymore if you did that. My advice keeps you the owner, and just adds an extra rule for _www to the folder. Verify using ls -l ~/Documents.
    – Daniel Beck
    Apr 23, 2012 at 13:15
  • 1
    @Enchilada It'll just prevent access from other users on the machine that would have been e.g. in staff group. Owner and group are independent. The best match applies. You can even prohibit the "owning" group's access but allow for "others", but that's only useful if group membership can only reassigned by administrators.
    – Daniel Beck
    Apr 23, 2012 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .