Insecure permissions recommended for mod_wsgi

[voxpupuli]

Insecure permissions recommended for mod_wsgi

[daenney]

My documentation says 'own it', not be able to write to it. chown user:group and chmod +x chmod +w is not the same.

[daenney]

I'm all for moving this out of /var/www though because I do see your point, a lot of people have that directory automatically exposed through their HTTPd's so that might cause trouble.

[sciurus]

"My documentation says 'own it', not be able to write to it."

I'm a little confused by the distinction you're trying to draw here. With a standard 0022 umask, files will be created with the permissions -rw-r--r-- and directories with drwxr-xr-x. Unless you explicitly document removing write permissions, puppetboard users are going to leave things writable by the web server.

Since I'm not super familiar with mod_wsgi, I wanted to check if there really is a reason the user the application is running as needs to own that file. In my testing it seems the answer is no. If not, I can revise the documentation to change those steps. I can also add a little bit of info about setting puppetboard up on Fedora. If that sounds good let me know and I'll get a PR to you when I have a chance.

[daenney]

Ah great. I was always told that the WSGI file needs to be owned by the user it'll run as but it makes sense that read privileges would be enough.

Feel free to send the PR!