Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this folder structure :


and want the access to the files (source code) in Export and Site to be allowed only for a group of user in "priv_group" and not allowed for others even for server administrator (but other users should still be able to run the scripts in Export and site folders). "Files" folder should be accessible for all.

I'm using an apache server on linux

the only requirement that i want to achieve with this, is that no other non "priv_group" user should be able to see or copy the source code

i thought of doing this:

apache process running by group : www-data
group of users that should have access to source files : priv_group
drwxrwx---  www-data    priv_group Files/ 
-rwx--x---  priv_group  www-data   Export/  
-rwx--x---  priv_group  www-data   Site/

is this enough and would it prevent access to website pages (in Site/) and for scripts files that should be run by other users (in Export/) ?

Any advice on the setup i should do to achieve this ?

share|improve this question

migrated from Jan 9 '14 at 13:54

This question came from our site for information security professionals.

Linux/Unix file permissions have three types of access: read, write and execute. You didn't specify which of these types of access you want the priv_group group to have. Restricting a server administrator is pointless as they have the ability to lift any restrictions. Directories and files are distinct and even if users have access to a directory, they can still be restricted from reading, writing and executing files in that directory (although they may be able to delete files if they have the write privilege on the directory). – Ladadadada Jan 9 '14 at 13:10
Linux privileges can get more complicated than this with extended attributes and SELinux/Apparmor/grc but a discussion of that doesn't belong in a comment requesting clarification. – Ladadadada Jan 9 '14 at 13:11
@Ladadadada edited my question to add more details , sory for not being clear this is my first try with securing a webserver – Mouna Cheikhna Jan 9 '14 at 13:40

You must log in to answer this question.

Browse other questions tagged .