Re: Write permissions required for roundup-server

Hi Nagy:

In message <20210409174726.199bde78@Dell>,
Nagy Gabor writes:
>On the webserver, I want to set as minimal file permissions, as
>possible. For which files do I need to set write permissions to properly
>run roundup-server (assuming that I have no extension that requires
>extra permissions)?
>
>My guess: the .log and .pid files, and of course the "db" directory in
>my tracker home. Anything else?
>
>(And I gave no (read) permission to other users, for safety. I think
>this is mainly required for config.ini as it contains mysql passwords,
>and for the "db" subdirectory.)

Looking at https://wiki.roundup-tracker.org/RoundupWithApparmor what
you list looks right. That is set up to run roundup as a server behind
a proxying web server. But it should be ok for mod_python or wsgi as
well.

One thing to consider is that python will attempt to compile .py files
into .pyc, so you might want to pre-compile using the py_compile
module. If you don't allow write access to detectors/extensions/lib
directories it won;t be able to compile the scripts for future use. I
am not sure that is a big win with a persistent process but...

Have a great evening.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.