Is there a Linux file permission that allows the app to read a file but not a user?

Question

I need /var/www/config/config.json to be read by my app but not by users calling myapp.com/config/config.json. How would I do that?

Answer 1

There are two main methods. One is to run your app as a different user from your web server, change the permissions on files so that they can only be read by the user running the app, and then proxy to it using your web server. You can use nginx as a proxy, for example:

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass        http://localhost:1234;
        proxy_set_header  X-Real-IP  $remote_addr;
    }
}

If that's no good for you you could instead set up a rule like so to have your web server block them directly:

location ~ /config\.json$ {
    deny all;
}

This can also be done with Apache using something like this in your .htaccess:

<Files ~ "config\.json$">
    Order allow,deny
    Deny from all
</Files>

Answer 2

If you use SELinux, you can set the context to stop httpd and its subprocesses from accessing the file. I accidentally do that to myself all the time.