Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I have a script that is to be executed by the nobody user, why is there a need to assign group read and execute permissions. For example in the article at http://www.zzee.com/solutions/unix-permissions.shtml, it notes that the permission 755 should be assigned to scripts on a web server. I understand that the user nobody is treated as others and as the owner of the script I would like full permissions. Am I missing something?

share|improve this question
    
I am not clear on your question. The script permissions define who can run, read, modify it. If it is owned by nobody and the webserver is run as nobody (and assuming no suphp etc), then only nobody needs any permissions to the script in order for the webserver to run the script –  Paul Apr 5 '12 at 5:20
    
well, accoring to that link, ""nobody" belongs to "others" group". I didn't think "others" was a group, I'm not big on linux so don't know if that's right. But if so then I suppose you may need the same permissions on group and on others. that's what they've done..On a more sure point though, 5 is not write and execute permissions by the way, 5 is read and execute. I wonder if actually "others" is not part of any group, so one might ask, why not 705? perhaps you know or perhaps you were asking that too? –  barlop Apr 5 '12 at 17:52
1  
@Paul - What I meant was is nobody is a user that belongs to others or is nobody a user that also exists as a group? I understand that the web server is run as the user nobody so I would think that to read and execute the script, the permissions required would be 705 i.e. rwx for the user who own the file, no permissions for the group and r-x for others. –  PeanutsMonkey Apr 6 '12 at 5:22
    
@barlop - Sorry, I wrote down write instead of read permissions. I have amended my question. –  PeanutsMonkey Apr 6 '12 at 5:24

1 Answer 1

up vote 1 down vote accepted

With linux permissions, others means "everyone else". So lets say you have a file with permissions like this:

-rwxr-x--x 1 peanut users 256 Jan 1 myscript

Ignoring the first -, we have rwx first, which are the user permissions. The user is the account that owns the file, and is in the third column: peanut. This user is permitted to read, write and execute the file.

Next we have r-x which are the group permissions, and the group in question is in the fourth column: users. Anyone who is a member of this group is permitted to read and execute this file. You can see group membership by doing:

$ grep users /etc/group
users:x:100:tom,dick,harry

This shows the group id 100 and anyone who is not a primary member of the group. Primary members can be found by searching the passwd file for members - anyone who has 100 in the fourth column is a primary member:

 peanut:x:1000:100:peanut,,,:/home/peanut:/bin/bash

The last permissions are --x which are the others permission, or "everyone else" - ie, every one who isn't either the user or a member of the group. This would include the user nobody if it exists, but also any other user. So everyone else is permitted to execute this file.

Quite often, the webserver on linux is run under its own account, sometimes nobody sometimes www-data sometimes httpd sometimes apache. Whatever the user is that runs the webserver daemon, if you want it to execute a script, then it needs permission to do so. It is rare that you would make the webserver user the owner of the script or a member of the group that owns the script, so this only leaves the others permission to give it access.

An alternative approach for a site running multiple websites, is to create a user per site, then use suexec to say in the virtualhost definition which user should be used to execute scripts. This way you don't need to give the webserver any explicit or implicit permission to the scripts.

share|improve this answer
    
So you seem to be saying that indeed one could say 705. Also, does execute permissions(1) include read permissions. since if one can execute a file, then one can read it. Even though when setting the execute bit alone, the read bit is not set. –  barlop Apr 6 '12 at 11:23
    
@barlop Yes, a script needs to be readable in order to run it. In fact, you don't need the execute bit set for a script to run it, you can just pass it to the interpreter like python myscript. If you make it executable, and put the right shebang line at the beginning of the script, then you can execute it by name. You usually don't need the execute bit set for a script run by a webserver as it will generally invoke an internal or external interpreter. –  Paul Apr 6 '12 at 13:23
    
pastebin.com/raw.php?i=HN0kY4Pa <-- 2 examples from cygwin. one is a script not readable but executable and executes. another is a script that is readable not executable, and it executes even though not (Exlicitly at least) passed to bash –  barlop Apr 6 '12 at 13:37
    
@barlop cygwin isn't linux. Clearly you can read the file as you can cat it. So while you don't have explicit read permissions from a cygwin perspective, windows is letting you read it without read and execute it without execute. –  Paul Apr 6 '12 at 14:10
    
@Paul - Thanks Paul. As always your answers are in detail. A few questions arise though. How do I know the users that fall under the category of others? Why are primary group members kept separate from the group file? –  PeanutsMonkey Apr 9 '12 at 19:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.