[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Config files which are writable by www-data

On Sat, Feb 09, 2008 at 10:09:13AM +0100, Roland Gruber wrote:
> The problem is that my application provides a set of default templates
> for user creation. These files must be editable via the application
> itself and therefore reside in /var/ldap-account-manager.

I most sincerely hope they do not.

> But the files are overwritten on every package installation because they
> are not treated as config files in Debian's sense.

Well, don't do that, then.  Ship the template files somewhere else, and then
copy them into /var if they're not already there.

> Now I think about moving the files to /etc. But Debian policy sais that
> files in /etc should be owned by root and writable only by the user.
> So what can I do? Would it be ok to assign these files to group www-data
> and allow the group write access? Or would it be better to own them by
> www-data and not root?

There are already some files in /etc that are writable by www-data, so
that's a possibility too.  It comes down to direct admin editability -- is
it expected that sysadmins may want to futz around with these template files
using a text editor, or is the only sensible way of dealing with these files
through the application?  If the former, /etc.  If the latter, /var.

- Matt

Reply to: