Re: [Leap 16.0] apache2 group wwwrun or www?

 On Sun, 19 Jul 2026 23:19:31 +0000, David T-G <[email protected]> wrote:
> ...
> % What is correct - www or wwwrun?
> [snip]
>
> I have long preferred having a wwwrun user with a wwwrun group so that
> the daemon can update any files it *should* but also a www user with
> both www and wwwrun groups so that it can update content that the daemon
> should *not* be able to change (plus anything the daemon can change,
> since the owner might trim or rotate or whatever).  Writing a log file?
> Definitely the run user.  Changing a static content file for some quickie
> cgi script?  Sure, although the whole idea is a kludge.  Changing the
> script itself or any other content?  Noooooo ...
>
> So, having followed this thread as well as my befuddled old brain can
> keep up, I have come to the understanding that there is no longer a
> differentiation between the run user (limited modify ability) and the
> content owner (changes OK).  How do folks keep things secure these days?

I don't have any experience with web server stuff, but for this
question the apache2 and nextcloud packages both require group(www)
and user(wwwrun).  I can't be positive that means that www should be the
primary group of user wwwrun, but especially since nextcloud complained
about files having wwwrun:wwrun ownership, it looks like it.

In fact, for all other packages, none is dependent on "group(wwwrun)".
They either require user(wwwrun) or group(www) or both.  In the following
search I have pruned all but the latest version of each package from
the results:

 # zypper if --provides system-user-wwwrun  |sed -n -e '/^Provides/,$p'
 Provides       : [4]
     user(wwwrun)
     group(www)
     group(wwwrun)
     system-user-wwwrun = 20170617-160000.2.2

 # zypper se -v --requires-pkg system-user-wwwrun
 [...]
 S  | Name              | Type    | Version           | Arch   | Repository
 ---+-------------------+---------+-------------------+--------+----------------

    | apache2           | package | 2.4.66-160000.3.1 | x86_64 | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | apache2-mod_fcgid | package | 2.3.9-bp160.1.12  | x86_64 | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | bugzilla          | package | 5.0.6-bp160.1.9   | noarch | repo-oss (16.0)
     requires: user(wwwrun)

    | bugzilla-apache   | package | 5.0.6-bp160.1.9   | noarch | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | bugzilla-lang-de  | package | 5.0.6-bp160.1.9   | noarch | repo-oss (16.0)
     requires: user(wwwrun)

    | cgit              | package | 1.2.3-bp160.1.12  | x86_64 | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | eximstats-html    | package | 4.98.2-bp160.2.1  | x86_64 | repo-oss (16.0)
     requires: group(www)

    | gitolite          | package | 3.6.13-bp160.1.11 | noarch | repo-oss (16.0)
     requires: user(wwwrun)

    | mailgraph         | package | 1.14-bp160.1.6    | noarch | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | matomo            | package | 5.1.2-bp160.1.10  | noarch | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | munin-node        | package | 2.0.72-bp160.1.4  | noarch | repo-oss (16.0)
     requires: group(www)

    | nextcloud         | package | 31.0.4-bp160.1.3  | noarch | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | php8              | package | 8.4.23-160000.1.1 | x86_64 | repo-oss (16.0)
     requires: group(www)
     requires: user(wwwrun)

    | php8-fpm          | package | 8.4.10-160000.2.2 | x86_64 | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | phpMyAdmin        | package | 5.2.1-bp160.1.9   | noarch | repo-oss (16.0)
     requires: group(www)

    | postfixadmin      | package | 3.3.15-bp160.1.5  | noarch | repo-oss (16.0)
     requires: group(www)

    | robinhood-webgui  | package | 3.1.7-bp160.1.12  | x86_64 | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

    | roundcubemail     | package | 1.6.16-bp160.1.1  | noarch | repo-oss (16.0)
     requires: user(wwwrun)

    | webdot            | package | 2.30-bp160.1.9    | noarch | repo-oss (16.0)
     requires: user(wwwrun)
     requires: group(www)

-- 
Robert Webb