1

As far as i unterstood, every file wich should be changed by php/apache have to be writeable by the user of the apache server process. According to the "Hardening Section" of the Wordpress docs, this user should differ from the owner of the files and only the latter should have write access to the most folders. So, i wonder how wordpress is able to update if the server process dont have write access?

I dont understand what is meant by: "When you tell WordPress to perform an automatic update, all file operations are performed as the user that owns the files, not as the web server’s user. All files are set to 0644 and all directories are set to 0755, and writable by only the user and readable by everyone else, including the web server."

For me that sounds very crazy. If the files are owned by root, does wordpress gain root access to the server?

Improve this question
1
  • 1
    I'm not sure that documentation is correct. No, it certainly can't just become root, or automatically switch users at all I don't think. So in order to update it'll have to ask you to enter root credentials so it can use them temporarily to update.
    – Rup
    Nov 24, 2020 at 14:33

1 Answer 1

Reset to default
3

TLDR: That paragraph is incorrect.

So How Does WordPress Handle Permissions For Auto-Update?

WordPress runs as the user that PHP runs as, which on most servers is some form of www user. It uses that user to perform the update.

If that user cannot write to those files, it falls back to other WP_Filesystem providers. This is why some people see a request for FTP details when updating. If FTP details are entered and they are valid, WordPress will use FTP.

If it cannot make direct filesystem changes, and it cannot use FTP to do it, then auto-updates cannot happen.

Can WordPress Run File Operations as The Owner of the file?

For me that sounds very crazy. If the files are owned by root, does wordpress gain root access to the server?

No. It can't.

PHP processes can't escalate themselves to the root user, that's not how things work. It's not how processes and users work either.

PHP cannot change the user it is running as either. That requires server configuration changes to do.

Is The Paragraph on .org Correct?

When you tell WordPress to perform an automatic update, all file operations are performed as the user that owns the files, not as the web server’s user. All files are set to 0644 and all directories are set to 0755, and writable by only the user and readable by everyone else, including the web server.

That paragraph is wrong.

What I think has happened, is that somebody who is not a native english speaker has written that paragraph, or that they themselves have misunderstood how updates work. Whatever the reason, this paragraph is incorrect, wrong, false.

However, if you want to really harden WordPress, make the files executable and readable by the web user, but not writable, and disable the built in auto-updater.

Then tools such as git, composer, or WP CLI can be used to update WordPress and its plugins/themes either manually or on a cron job using a different user.

E.g. on my host I can SSH into the server and make changes as my SSH user has access to those files. This way any malware that runs cannot modify PHP files. This has the downside that WordPress is unable to update itself from the web interface. I then run WP CLI commands to update WP and .org plugins, and a combination of git pull and composer commands for the rest. I could even refactor things to use composer for the entire site.

You'll see some high end hosts do something similar by managing WordPress themselves, and providing you with a git repo that's equivalent to wp-content so that plugins and themes are version controlled. This has the benefit that any changes are immediately obvious and can be undone instantly.

Improve this answer
9
  • I don't think it's much wrong, maybe just: "all file operations need to be performed". But it doesn't explain how that happens, and I guess that means the update won't happen automatically unless WordPress caches these credentials (I've never dug into that, and it probably shouldn't).
    – Rup
    Nov 24, 2020 at 14:43
  • @Rup it is demonstrably wrong, but I gather the author probably meant something else and mistranslated
    – Tom J Nowell ♦
    Nov 24, 2020 at 14:45
  • I would think the theory of a mistranslation is plausible. I really wished wordpress would show me, how i can gain rights of the user who owns a file :). But thank you for clarification. I am also not a native speaker so i was a bit unsettled and obviously 'lost in translation'. PS: Great idea to use composer.
    – eltitano
    Nov 24, 2020 at 15:18
  • There is no way for WordPress to "gain the rights of the user who owns the file", you either have the ability to write to the file or you don't. Either directly, or via the filesystem API. If WP could do this then there would be no point hardening it, and we would have a major security problem. The text you reference is incorrect, inaccurate, wrong, and misleading. It describes something that is not possible. Why it is was written that way is another question entirely.
    – Tom J Nowell ♦
    Nov 24, 2020 at 16:21
  • 2
    @eltitano permissions and ownership will depend on your server. If you can get away with not setting executable then great, but the key point was that it is not writable
    – Tom J Nowell ♦
    Nov 25, 2020 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.