Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
The default setting is that the apache2 root-directory Documents is owned by root and I have to enter a password each time I change it. This is why I want to give full permissions to my user account in the file information:
However, I'm not sure whether that might be a security risk since the default settings are so restrictive.
Yes it can be a security risk and can be considered as a security breach if your main account gets compromised or if you do something wrong by mistake - it differs from case to case depending on how important your project is and what you are dealing with. But if I were you, I would never use 777 permission or even something similar that anyone can easily make changes to my WebServer Directories. In other words, even if I own two Unix Users, one my X user and the other the root user, I won't give permission to X only because I'm looking for ease. On MacOS, like on Linux or any other Unix-Like OS, you can use ACLs - Access Control Lists -, you can set Attributes, or you can configure Apache in a way to have different root directories for different virtual hosts if you are going to deal with hundreds of users being in need of changing their own odds and sods inside the apache directories, but never underestimate DACs. Permissions that you mentioned are considered as DACs (Discretionary Access Control), 3 bits for the owner, 3 for groups, and 3 for others - also called staff. Anyway, I recommend you read about ACLs, I guess they will do what you need, default ACLs are used for granting/setting access control list on a specific directory to allow specific users and groups to have access right. For a quick insight on ACLs, you can use chmod with +a option to set or -a option to remove ACL. You can also you ls -le to display set ACLs. For instance:
chmod -R +a "group:_www allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" yourDirectoryORFile
ACLs are a better option - than changing permissions - that you can benefit form.
By the way, you should notice that that it is right that MacOS is safe and secure, but services including Apache, SSH, SAMBA, etc. are not secured since they are using and configured by the default state.
File and Directory permissions are one of the very basics and first permissions you will face with in Unix-Like Operating Systems. To secure your system, you really need to pay a close attention to every detail of the system depending on your purpose. Giving a full permission seems like you are deliberately providing security breaches in your system.
When it comes to Apache Server - or NGINX - you should first make sure about your directory safety. For instance in Linux, it's recommended not to disable SELinux (used for managin Mandatory Access Control, Role-Based Access Control - RBAC - and etc.), so in that case, after setting right permissions for directory and files, you can set roles and types in a deeper level of security. If it wasn't needed, everyone would use 777 - Read-Write-Execute for all Users, Groups, and Staff, so be sure there is reason why it isn't 777 by default.
And the next thing you should beware of, is your Firewall configuration and rules. MacOS is using PF since it's built on top of a FreeBSD microkernel (PF stands for Packet Filter - and IPFW stands for IPFireWall). You can use man pfctl to read its manual page and understand how you can deal with it.
I can't think of a reason why that would be a problem.
Apache doesn't run with your user creds so no outside user is going to be able to get into that directory simply by giving yourself read/write permissions.
The default is just a mere application of the Principle Of Least Priviledge. It is not intended to protect your main account from what could happen in the apache server, but to protect the apache sites from inadvertant actions from your account.
If you ordinarily have to write some files in some folders below the apache2 root-directory Documents, you should give you write accesses to only those folders. If you occasionaly do administrative tasks on all apache2 folders, you should sudo to an administrative account having full access there - it need neither to be root nor your main account.
You should only have write access on the apache2 root folder if writing there is an important part of your normal activity on that machine.
There is no specific risk in not doing that besides inadvertant actions (what about editing an operational file while wanting to do it on a test file?), or compromission of your own account. So it is as with all other security principles: you must be aware of it, and simply know why you do not apply it. For example, if the general organization of the machine implies that if your main account have no write access there you must be logged as root more that half the time, it is probably worse.
TL/DR: the default that only root has r/w access to apache2 root Document is just the Principle Of Least Priviledge. It is up to you to know whether it is or not relevant in your particular use case.
