Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am not sure if this is answered elsewhere or it is too obvious but I need to have a folder that I create with a new user(admin) both on windows and ubuntu (wherever it is possible - preferably both) and allow only me to modify it and all the others(incl. admins) to only execute it.

It would be even better if files are only available to execute and not read but I suspect this is possible. I have tried to change permissions in windows but the blocked user(admin privileges) can revert the settings back and be able to edit again.

The same is with linux with the chmod or chown commands.

Quick explanation of my situation and why I need this if someone has alternative solution: I need to set up a local web app (with server) and I don't want users to be able to modify, or even better not be able to see just execute php or javascript files because of app security.

share|improve this question
    
The point of Linux's root is that you trust it. –  ignis Feb 6 '13 at 8:48

3 Answers 3

The problem you are facing is do to the fact that you have people with admin/root access on the server. Having such privileges gives them full access to anything on that server and there isnt anything you can do about it. Even if you change ownership or security settings, they will be able to take them back. That is the nature of the "superuser" user - complete control.

You can move the webapp to a server where they do not have admin/root access, then your problem is solved. On a separate machine you can give them only the privileges they need.

share|improve this answer

I'm not sure I understood correctly. Is the local web app on the same LAN as the users or on the same computer?

If it is on the same computer, you need to protect your filesystem using chmod/chown and protect your web server. However, this way of doing is particularly unsafe. This is already tricky with unprivileged user, but if your users have admin rights, changing read/write/execute permission won't prevent them from looking at your script and alter it if they want. You can do nothing against that: they have all powers, just like you.

If it is on the same LAN, you don't have to worry about who can see what on the server hard disk (well, at least not that much :)). If user A could access and modify script S when logged-in locally, he cannot modify S through the web server. If he can (or if anyone can do it remotely), then your web server is not configured correctly. This is not a matter of filesystem permission, it's a matter of web server configuration.

Javascript is more tricky than PHP: PHP is executed on the server. Your client should not see it. Javascript is executed on the client machine. If he wants to read/alter and execute this script, he can. If he does, however, this won't change anything on your server: he can change his local copy of the script only.

EDIT:

The only way to hide stuff from the other admins are:

  • Encrypting your files
  • Tweak the OS to hide them

The corresponding problems are:

  • Encrypted files can't be executed as they are. They have to be decrypted before execution. Which means that your PHP script have to be in clear text somewhere. Which means that a curious admin can do whatever he wants with it.
  • There are ways to hide files under Windows using some specific registry tweaks (the way some viruses use to hide themselves). As well, one could alter Linux kernel to do the same thing. But, once again, a curious/motivated admin can revert back these changes or find a workaround. And, guess what, you still have to make your script visible to the webserver user: as an admin, it's so easy to impersonate such a user (trivial workaround found)...

Conclusion, as I previously said, what you need is a computer where the other users have no rights... Or even better, a computer where they can't log in!

share|improve this answer
    
The server is started on the same machine and that is the problem, the app is run on localhost. Maybe there are third party apps that can help me protect files? –  korun Feb 5 '13 at 17:54
    
I'm sorry to tell you that but, no. You can "protect" things by hiding them but that's it. An admin is an admin: he can do whatever he wants... including reverting your doings. :/ But what kind of app is it? Why is it so important to hide it? –  user183734 Feb 5 '13 at 17:59
    
It is a accounting app and if they edit the php files required for login check they can easily access the whole database. I know it is a local app and the user is responsible for their install and data localy but I just wanted to make sure that there is nothing you can do without a third party app. –  korun Feb 5 '13 at 21:32
    
No, easy file locker is not a solution: it encrypts the files. If the files are encrypted, the cannot be executed! Such solutions exists under Windows and Linux, but it won't solve your problem. Put your scripts on another machine and run the webserver on it. Please understand that if the webserver has access to those files, an admin also has access to those files. –  user183734 Feb 6 '13 at 8:23
    
I added some pieces of information to my answer. And I repeat: Easy File Locker does not protect your files. You may not trust my words. It's fine with me: it's not my server that will be compromised. –  user183734 Feb 6 '13 at 8:41

Alternative solution I found is a freeware app on Windows:

Easy File Locker - http://www.xoslab.com/efl.html that does this job perfectly.

The only problem I have is that the <?php include ''; ?> is not working if file is hidden but editing is very well blocked for all files.

Still looking for linux/ubuntu alternative.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.