# File permissions for Rails app - how much can I lock it down

**URL:** <https://www.ruby-forum.com/t/file-permissions-for-rails-app-how-much-can-i-lock-it-down/90186>\
**Category:** Rails\
**Created:** [March 26, 2007, 7:00pm UTC](https://www.ruby-forum.com/t/file-permissions-for-rails-app-how-much-can-i-lock-it-down/90186 "2007-03-26T19:00:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wpwood](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d6d6ee/32.png) [@wpwood](https://www.ruby-forum.com/u/wpwood)\
**Post date:** [March 26, 2007, 7:00pm UTC](https://www.ruby-forum.com/t/file-permissions-for-rails-app-how-much-can-i-lock-it-down/90186/1 "2007-03-26T19:00:50Z")

</div>

I want to lock down my site as much as possible and would like to set  
the file permissions as restrictively as possible.

Is there any reason that any file used by my app but not in the /public  
directory needs or should have Read, Write, or eXecute for Public  
permissions?

Thanks,  
Bill

---

<div class="post-metadata">

**Author:** ![wpwood](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d6d6ee/32.png) [@wpwood](https://www.ruby-forum.com/u/wpwood)\
**Post date:** [March 26, 2007, 11:39pm UTC](https://www.ruby-forum.com/t/file-permissions-for-rails-app-how-much-can-i-lock-it-down/90186/2 "2007-03-26T23:39:11Z")

</div>

If you are running mongrel then all of your apps code outside of  
public can be locked down to just the user that mongrel runs as.

-Ezra

On Mar 26, 2007, at 9:59 AM, Bill W. wrote:

> >

– Ezra Z.  
– Lead Rails Evangelist  
– removed\_email\_address@domain.invalid  
– Engine Y., Serious Rails Hosting  
– (866) 518-YARD (9273)

---

<div class="post-metadata">

**Author:** ![wpwood](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d6d6ee/32.png) [@wpwood](https://www.ruby-forum.com/u/wpwood)\
**Post date:** [March 27, 2007, 12:12am UTC](https://www.ruby-forum.com/t/file-permissions-for-rails-app-how-much-can-i-lock-it-down/90186/3 "2007-03-27T00:12:16Z")

</div>

Hi Ezra,

Ezra Z. wrote:

> If you are running mongrel then all of your apps code outside of  
> public can be locked down to just the user that mongrel runs as.

Thanks much for that info. Does that change when I stop / start  
mongrel?  
Like its pid? Or is it a constant? In any event, I assume that mongrel  
is  
at least part of the Group, so I can get started on changing all the  
Public  
permissions anyway. Thanks!

Best regards,  
Bill

---

<div class="post-metadata">

**Author:** ![wpwood](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d6d6ee/32.png) [@wpwood](https://www.ruby-forum.com/u/wpwood)\
**Post date:** [March 27, 2007, 6:35pm UTC](https://www.ruby-forum.com/t/file-permissions-for-rails-app-how-much-can-i-lock-it-down/90186/4 "2007-03-27T18:35:14Z")

</div>

Hi Russell,

Exactly the kind of thing I imagined myself doing, and why I asked here  
before I dug myself into a hole 😉 Thanks.

Bill  
----- Original Message -----  
From: Russell N.  
To: removed\_email\_address@domain.invalid  
Sent: Tuesday, March 27, 2007 10:51 AM  
Subject: [Rails] Re: File permissions for Rails app - how much can I  
lock it down?

Wouldn’t you want log to be an exception? I just this weekend locked  
my username out of a logfile created by my app and had to read it as  
root. Heh.

RSL

On 3/26/07, Bill W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

```
Hi Ezra,

Ezra Z. wrote:

> If you are running mongrel then all of your apps code outside of
> public can be locked down to just the user that mongrel runs as.

Thanks much for that info. Does that change when I stop / start 

```

mongrel?  
Like its pid? Or is it a constant? In any event, I assume that  
mongrel is  
at least part of the Group, so I can get started on changing all the  
Public  
permissions anyway. Thanks!

```
Best regards,
Bill

```

---

<div class="post-metadata">

**Author:** ![wpwood](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/d6d6ee/32.png) [@wpwood](https://www.ruby-forum.com/u/wpwood)\
**Post date:** [March 27, 2007, 5:54pm UTC](https://www.ruby-forum.com/t/file-permissions-for-rails-app-how-much-can-i-lock-it-down/90186/5 "2007-03-27T17:54:07Z")

</div>

Wouldn’t you want log to be an exception? I just this weekend locked my  
username out of a logfile created by my app and had to read it as root.  
Heh.

RSL