Home / server / Questions / 312691
Accepted
ren
Asked: 2011-09-19 04:22:47 +0800 CST

www-data user can read /etc/fstab

  • 772

I'm pretty new at this. So I figured out that apache2 starts processes as www-data user. Suppose this user then starts untrusted code. What if I wanted to disallow this user to read any files (like /etc/fstab for example). How would I go about this? Ubuntu 11.04 by the way.

ubuntu apache-2.2 security www-data

2 Answers

  1. Are there secrets in /etc/fstab you don't want users reading?

    In general, you'd remove r access for others on the files, but fstab contain no secrets so you just likely to break things.

    Specifically with Apache, you probably have the option to run it in a chroot, so it can't read outside of /var/www or where ever your httpd lives.

    • 4
  2. Best Answer

    You could deny by chmoding those files so that www-data user can't read them.

    One of tricks you could use would be to change group of those files to www-data group and set mod so that group can't read the files.

    $ chgrp www-data /etc/fstab
$ chmod g-rwx /etc/fstab

    From php side you can use open_basedir which would in some cases prevent reading files outside path set as open_basedir

    • 1