drupal-file-permissions

Drupal File Permissions Security

Standards for securing Drupal file permissions in Docker environments and production servers, ensuring proper security while maintaining functionality.

actions:

• type: enforce conditions:

  • pattern: "chmod\s+(?!755)\d+\s+[^\n]*sites\/default(?![^\n]*files)" message: "sites/default directory should have 755 permissions (read-only for group/others)"

  • pattern: "chmod\s+(?!444)\d+\s+[^\n]*settings\.php" message: "settings.php should have 444 permissions (read-only for everyone)"

  • pattern: "chmod\s+(?!444)\d+\s+[^\n]*services\.yml" message: "services.yml should have 444 permissions (read-only for everyone)"

  • pattern: "chmod\s+(?!755)\d+\s+[^\n]*sites\/default\/files" message: "sites/default/files directory should have 755 permissions with proper ownership"

  • pattern: "chown\s+(?!www-data:www-data)[^\s]+\s+[^\n]*sites\/default\/files" message: "sites/default/files should be owned by the web server user (www-data:www-data)"

• type: suggest message: |

  Drupal File Permissions Security Best Practices

  1. Critical File Permissions

  • sites/default directory: 755 (drwxr-xr-x)
  • settings.php: 444 (r--r--r--)
  • services.yml: 444 (r--r--r--)
  • settings.local.php: 444 (r--r--r--)
  • sites/default/files: 755 (drwxr-xr-x)
  • sites/default/files/ (contents): 644 (rw-r--r--) for files, 755 (drwxr-xr-x) for directories

  2. Ownership Configuration

  • Web root: application user (varies by environment)
  • sites/default/files: web server user (www-data:www-data)

  3. Implementation in Dockerfile

  # Set proper permissions for Drupal
  RUN mkdir -p /app/${WEBROOT}/sites/default/files && \
      chown www-data:www-data /app/${WEBROOT}/sites/default/files && \
      chmod 755 /app/${WEBROOT}/sites/default && \
      chmod 444 /app/${WEBROOT}/sites/default/settings.php && \
      chmod 444 /app/${WEBROOT}/sites/default/services.yml && \
      find /app/${WEBROOT}/sites/default/files -type d -exec chmod 755 {} \\; && \
      find /app/${WEBROOT}/sites/default/files -type f -exec chmod 644 {} \\;
  

  4. Permission Fix Script

  Create a script at /app/scripts/custom/fix-drupal-permissions.sh:

  #!/bin/bash
  
  # Exit on error
  set -e
  
  WEBROOT=${WEBROOT:-web}
  
  echo "Setting Drupal file permissions..."
  
  # Ensure directories exist
  mkdir -p /app/${WEBROOT}/sites/default/files
  
  # Set ownership
  chown www-data:www-data /app/${WEBROOT}/sites/default/files
  
  # Set directory permissions
  chmod 755 /app/${WEBROOT}/sites/default
  chmod 755 /app/${WEBROOT}/sites/default/files
  find /app/${WEBROOT}/sites/default/files -type d -exec chmod 755 {} \;
  
  # Set file permissions
  chmod 444 /app/${WEBROOT}/sites/default/settings.php
  [ -f /app/${WEBROOT}/sites/default/services.yml ] && chmod 444 /app/${WEBROOT}/sites/default/services.yml
  [ -f /app/${WEBROOT}/sites/default/settings.local.php ] && chmod 444 /app/${WEBROOT}/sites/default/settings.local.php
  find /app/${WEBROOT}/sites/default/files -type f -exec chmod 644 {} \;
  
  echo "Drupal file permissions set successfully."
  

  5. Verify Permissions

  # Check file permissions
  ahoy cli "ls -la /app/${WEBROOT}/sites/default"
  ahoy cli "ls -la /app/${WEBROOT}/sites/default/files"
  
  # Check Drupal status
  ahoy drush status-report | grep -i "protected"