Minimum (Hardened) File Permissions

Product Support Self-hosting

AI-generated summary

The discussion revolves around establishing minimum, hardened file permissions for Discourse. maltfield is seeking guidance on idempotent commands using chown and chmod to strip unnecessary permissions and grant access only to the minimum privileged user/group. Specifically, this applies to files/directories in the /var/discourse/ directory on the Docker host and inside the Discourse Docker container, particularly the web server’s document root.

maltfield outlines desired permission settings:

  • 0 world permissions
  • Read-write (2) for the web server’s user when write access is required
  • Read-only (4) for the web server’s user otherwise
  • Execute permission (1) for directories or files requiring it

sam suggests examining the container web.yml in discourse_docker as a starting point, but acknowledges that this is an unconventional request and may require experimentation.

1

Is there any published guidance for the proper/minimum/hardened file permissions for Discourse?

Specifically, I’m looking for a set of idempotent commands using chown and chmod to strip the permissions to be as low as possible and only grant them when necessary to the minimum privileged user/group.

I’d like this for both

  1. The files/dirs in the /var/discourse/ dir (and other important dirs) on the Discourse docker host and
  2. The files/dirs inside the Discourse docker container, especially the files/dirs inside the web server’s document root

For example, I’d like to make it so all the files/dirs in the Discourse container’s exposed document root:

  1. Have 0 world permissions
  2. Be read-write (2) to the web server’s user iff write access is required (ie: photo/attachment uploads dir)
  3. Be read-only (4) to the web server’s user otherwise
  4. Only have execute permission (1) if it’s a dir or is otherwise required for a file

Thank you

2

bump. Can the developers please chime-in? This would be very helpful to be documented..

3

Best I can offer is look at our container web.yml in discourse_docker it sets permissions up there.

This is off beaten path you will need to experiment.