In apache, why www-data owner of a web application directory is safer than recursive 777?

Question

I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep owner www-data or apache (Depends on my web server user) for my web application directory. All directories should have 755 and all files should have 644. Files with 644, Directory with 755 and owner of web application directory (recursive) is root or ubuntu, this looks good to me but my yii application is not able to create files in runtime and assets so I am not able to login as well as users are not able to upload files in upload directories.

If I give 777 recursive to uploads directory, it starts working fine but an intruder can upload a malicious file in it and all files are 777 so he can simply remove all of them.

If I give 777 to folder only, not the files then users are not able to modify uploaded file, that is one of functionality, so functionality does not work, for security purpose it is fine.

If I make owner to www-data of uploads directory recursive 755, it means user can upload files, modify files because www-data has read write permission for the directory and the content but intruder also have same permission for its malicious file. In this case, he can also remove all files.

Summary If I keep 755 for all files and 644 for all files with owner www-data of web application directory recursively. All works well, I do not need to give 777 to uploads, runtime or assets, it can create files inside these directories when user uses web application but an intruder can also create php files in these directories with owner of www-data that means, he has also full modify permission to all files of all directories. I do not want to handle this in apache to make execution of php files forbidden inside uploads. For different web applications, this name is different and many applications use multiple directories for upload. I do not want to deny all for php files of uploads folders. There should be correct permissions which could handle this better.

Please suggest.

Answer 1

The risks from a folder with 777 privileges and from a folder with 755 privileges owned by www-data are slightly different. In the case of the 777 folder, if an attacker is able to get control of any user on the server, they will be able to modify and delete the uploaded files. In the case of the 755 privileges, if they are able to compromise the www-data user (or any user in that group), they can still modify and delete the uploaded files, but if they compromise any other user, they can only read the contents of the files, without being able to make modifications.

If all users on the system are in the www-data group, there is no difference, but that isn't usually the case. For example, if the server runs a database as well as the website, the DBMS will usually run as a user in a different group. In this case, a flaw in the DBMS allowing code execution would not allow an attacker to directly affect the uploaded files, unless they could escalate their privilege to a member of the www-data group or root user.

For finely grained permissions, look at options such as Access Control Lists (ACL), which can allow more specific rules than the basic owner-group-everyone approach, or SELinux, which can implement mandatory access control to files and folders, meaning, for example, you can say "only processes with a particular flag can write to this folder". In either case, these are very easy to shoot yourself in the foot with - test carefully before applying to a live server!