By jaypan on

I've been thinking about the 3rd party libraries folder (generally located at [WEBROOT/libraries]. I have the permissions for this directory set at 755, as I do with other directories in Drupal. But when I think about it, this could be a security risk, as these are 3rd party libraries, and could be an opening for exploits. I also don't see any reason any of these directories should be writing files. But, I'm also not really a server guy. I've been using 'NIX servers for 20 years, but I've never read a book or taken a course, so I know just enough to cause major problems, without knowing enough to see them coming!

My thoughts: Setting the libraries directory and sub-directories to 750, and, and all the files contained to 640. 

Thoughts? I'm going to run this as a test on some low-priority sites, but I'm curious what others think about this.

Comments

ressa’s picture

ressa
he/him
commented

I got more or less the same approach as you, and follow the guidelines on the Securing file permissions and ownership for permissions. Will the guidelines on that doc page set it to 755?

When I caught a discrepancy in the Security Review module, I created the issue #3550828: .htaccess file is writable, using the current Securing file permissions and ownership doc page and got great actionable feedback from experts such as @smustgrave and @greggles (who I believe wrote the original "Securing file permissions and ownership" text?).

So maybe check if the Security Review module reports back what you expect (or not), and if you get no warning with 755, you could create an issue to get clarified if all is well?

jaypan’s picture

jaypan
Location Victoria, BC
commented

755 is what I've always had it set as, and I've never seen any reports from anywhere. This discussion wasn't born of a report from somewhere, rather just my own thinking in my brain. 

I haven't got any specific exploits or anything that I've seen. But I'm thinking that setting 750 on the libraries folder does seem to work.

From the page you linked to: 

$ cd /var/www/example.org/public_html/web
$ chown -R deploy:www-data .
$ find . -type d -exec chmod u=rwx,g=rx,o= '{}' \;
$ find . -type f -exec chmod u=rw,g=r,o= '{}' \;

These will recursively parse the web directory and set directories to 750 and files to 640, which is what I was discussing only for the libraries directory. So it seems my theory may have been correct, and not just for the libraries directory. Have you done this on a site?

Contact me to contract me for D7 -> D10/11 migrations.

ressa’s picture

ressa
he/him
commented

Yes, I use the commands from that page, resulting in these permissions, and stuff from libraries folder work well :)

$ ls -la web
[...]
drwxr-x---  3 user www-data 4,0K 15 jul  2025 libraries
drwxr-x---  4 user www-data 4,0K  3 dec  2025 modules
drwxr-x---  2 user www-data 4,0K  3 dec  2025 profiles
drwxr-x---  4 user www-data 4,0K  3 dec  2025 themes
[...]

About a report ... my suggestion is simply that you could try running Security Review module, and see what it says about your libraries folder having 755. It ought to flag it as insecure, no? And if not, you could create an issue for clarification, or suggest an improvement.