Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #231334

Re: website permissions and ownership

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 2/2/21 4:55 pm, Richard Hector wrote:
>
>> What you are doing sounds pretty O.K. Though I personally also use 
>> SELinux for web facing services.
>
> Thanks.
>
> I haven't looked in to SELinux. I looked at AppArmor, but it appears 
> that it won't work as expected in an LXC container, which is where I 
> run this. Would SELinux work there? SELinux, from what I can see, 
> seems more complex to learn than AppArmor.
>
SELinux is quite hard to get right, but when it's done properly it's 
very hard to exploit. Basically if it's not explicitly permitted it's 
forbidden.

SELinux has the advantage that it by default enforces rules that you 
should probably already have in place. So for example it will 
automatically stop writes to web content by the web server. You have to 
explicitly allow the web server to make modifications to specific files 
or directories. SELinux makes you think about what is important to you 
and what you think should be alterable on your website.

Getting back to my staging scenario, you start with default SELinux 
rules completely restricting web server write access to content. You'd 
have another set of SELinux rules that allow some other process to make 
changes to the content. You may even have a set of SELinux rules 
allowing the web server to write to an upload directory - but likely not 
read from it.

-- 
Jeremy

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 08:10 +0100
  Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 09:20 +0100
    Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 10:00 +0100
      Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 10:40 +0100
        Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 10:50 +0100
          Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 11:00 +0100
      Re: website permissions and ownership john doe <johndoe65534@mail.com> - 2021-02-02 10:40 +0100
        Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 10:50 +0100
  Re: website permissions and ownership Kenneth Parker <sea7kenp@gmail.com> - 2021-02-02 12:50 +0100

csiph-web