1

Is there any reason why PHP files would require write access? (Excluding directories that need to be writable)

I'm installing Magento via composer. They recommend the following permissions:

cd /var/www/html/<magento install directory>
find var generated vendor pub/static pub/media app/etc -type f -exec chmod g+w {} +
find var generated vendor pub/static pub/media app/etc -type d -exec chmod g+ws {} +
chown -R :www-data . # Ubuntu
chmod u+x bin/magento

Doing this makes the files writable. This is problematic. I also use the snuffleupagus PHP module to add a level of security. But, this also causes an issue when installing Magento because I get the error:

2019/12/02 03:48:57 [error] 6782#6782: *1 FastCGI sent in stderr: "PHP message: PHP Fatal error:  [snuffleupagus][0.0.0.0][readonly_exec] Attempted execution of a writable file (/var/www/shop/app/etc/vendor_path.php). in /var/www/shop/app/autoload.php on line 25" while reading response header from upstream, client: 192.168.33.1, server: ucp.local, request: "GET / HTTP/1.1", upstream: "fastcgi://unix:/run/php/php7.2-fpm.sock:

I'm wondering whether to make most of these files readable/executable as there is no reason for them to be writable on the server. Is there any reason why one shouldn't do this?

  • 1
    "Is there any reason why PHP files require write permissions?" - The documentation you refer to clearly says why it needs the files to be writable: "This is necessary so that the Setup Wizard and command line can write files to the Magento file system.". This is actually the second sentence in the paragraph you link to, before it even shows the command to execute. – Steffen Ullrich Dec 2 '19 at 5:55
3

I'm wondering whether to make most of these files readable/executable

PHP files do not need to be executable. That could be worse than having the write permission.

Furthermore, in the specific directories mentioned (e.g., var generated vendor pub/static pub/media app/etc) write permissions are probably required (at least for some file types). I have not tested it in depth, but generally it will break my Magento site if I don't give the permissions recommended (or a variation of them as I will mention next).

Recently I have been experimenting with an alternative permission scheme that I believe improves security. I asked a question about it here:

https://magento.stackexchange.com/questions/297324/linux-file-permissions-on-webroot-for-magento-2-when-755-and-644-are-not-good-en

The question comes from reading "You can have your cake and eat it too" at https://serverfault.com/a/357109. When I asked the question, I had not tried that scheme with Magento. I have tried it now and it works very well.

The other thing to be sure you have done is modify docroot to improve security. After doing this you should not have any executable files in the DocumentRoot of your Magento site. You can check from the command line like this:

find pub/ -type f -executable

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.