0

Is it safe to change the owner of /var directory the default owner is root. The sub directories inside var are www/html/domain.com I have changed the owner of all the directories inside var to Apache since I will be installing wordpress which works with apache ownership. Is it ok to change /var owner to apache?

4
  • 9
    No, it is not... There ought to be other directories in /var than just those belonging to the web server, or your system is strange. What is your main issue?
    – Kusalananda
    Feb 3, 2018 at 7:49
  • 3
    No, it is not, it is a major security risk. You also would better understand what you are trying to accomplish than asking how to do potentially insecure operations to a random bunch of strangers. Feb 3, 2018 at 9:29
  • 1
    Terrible idea. Removes any semblance of security.
    – steve
    Feb 3, 2018 at 10:27
  • 3
    xyproblem.info
    – Murphy
    Feb 3, 2018 at 10:30

2 Answers 2

3

You want your web server to have access to as little of your system as possible. I wouldn't change the owner of any file or directory to apache. I would use ACLs or possibly group permissions. But no matter what method you choose to accomplish the task, you should limit your scope.

There are many things in /var that your web server should not necessarily even have read access to, let alone write access, including:

  • Cached data from applications (including, say, your package manager)
  • Lock files
  • Log files
  • Mail and print queues

Given that, I would leave everything in its default, non-writable state to begin with. If you find that a particular file or subdirectory needs to be writable, add write access to that specific object. Following this policy, it is likely that even your document root at /var/www will remain non-writable.

3
  • Generally it is a very bad idea changing any part of the system to another owner than intended, subverting the design and security of the system on the process. The subjacent idea and the question is not that brilliant. Feb 3, 2018 at 15:25
  • I think I agree with everything you've said. Is there something I should mention in this post to make that more clear?
    – Fox
    Feb 3, 2018 at 15:28
  • I would make it clear that you should only touch a subtree, as the user initially did only bellow /www/html/domain.com. I am more concerned about the spirit of the initial question than your answer TBH ; you also have other alternative security setups, but I wont even go there with this kind of question. Feb 3, 2018 at 15:42
0

I did it. Its a terrible mistake. Remember that root might own all the directories within /var, but /var/log/mysql for instance is owned by mysql as is /var/lib/mysql, so doing this can severely mangle your system giving strange effects when trying to look at logs and remove files.

By change I mean I did a recursive change of all subdirectories using:

sudo chown -R root:root /var/*

Never do this!

And regarding apache2 you should actually use:

sudo chown -R www-data:www-data /var/www

The reason being that sometimes certain packages store dot files (.files) in /var/www which doesn't actually happen if apache2 doesn't have write permissions to /var/www. Its a rare issue not affecting everyone but I have seen it happen with python flask with almost impossible to find debugging issues.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .