I have created a webhook on github that calls my webserver for updating files in the web root. I have secured the sending part by using a token on github so only requests from github can execute the script. My question is since the script will run as the webserver(www-data) what is the best way to give it write permissions to the webroot. Is giving the webserver user write permissions on the webroot a good idea? What are the alternatives?

  • As you can read in various sources GIT isn't the best tool for actual deployment. As for how you want your deployment to work, that's up to you. You might give the user permanent permissions or temporary ones. You might have a script with an s-bit set that actually gets called or a number of other setups. What does your web application actually do? Does it accept user input? How many people are using it etc. that might all be relevant and also the kind of security you want. – Seth Dec 21 '17 at 8:36

First write a script that performs the exact deployment steps needed. Then give www-data the rights to run that specific script via sudo. For example, using the following sudoers rule:

www-data ALL=(someuser) /path/to/deploy.sh

(Replace "someuser" with the account which actually owns the webapp's files.)

The webhook handler would then execute:

sudo -u someuser /path/to/deploy.sh

This way, your webserver can perform updates exactly as scripted but still doesn't have unnecessary access to delete files or install malware to the site.

  • I have disabled all shell execution functions for PHP(my webhook script), so I would need to change that, plus I think instead of making changes to the sudoers file I can create the executable with SUID. – Ravi Dec 21 '17 at 9:59
  • Shell scripts cannot be SUID, so it would have to be a compiled program – and there's a much greater chance of making mistakes there. Besides, if you have disabled all shell execution functions, how will you perform the deployment anyway? – grawity Dec 21 '17 at 10:37
  • I am not sure if I'm making this overly complex but the deployment script can listen on a socket which the webhook passes data to. This avoids suid and execution part from PHP. – Ravi Dec 21 '17 at 11:13
  • Then the whole thread becomes irrelevant, because your webhook doesn't write any files in the first place! – grawity Dec 21 '17 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.