0

Yet another Apache 403 question I'm afraid, but the question here is a bit more specific. I gather that the error I'm encountering

(13)Permission denied: access to /~Rax/ denied (filesystem path '/Users/Rax/Sites') because search permissions are missing on a component of the path

can be fixed by giving execute permissions to every directory on the path to the User (_www) specified in /private/etc/apache2/httpd.conf. But this seems insane: it means _www has execute permissions for my home directory. Is this really the correct approach? Is there no way to reach the Sites folder by some kind of indirection ("skipping over" /Users/Rax/)?

1
  • Clearly _www needs these permissions for Sites so that Apache can serve from that directory, but requiring the same for Rax, my user directory, just doesn't sound right (or wise).
    – orome
    Feb 8, 2014 at 4:05

1 Answer 1

1

This isn't fabricated by Apache — execute man 7 path_resolution on your system. The three ways around it are to make your home directory world-executable, make your home-directory group-executable and share a secondary group with your webserver userid, or move your content out of your home directory.

11
  • Yeah, I've been looking into it and it seems there's no way around it. I use the sever on my machine for development, so what I've set up now is a script script that does chmod -v o+X /Users/Rax; sudo apachectl start when I need the server and chmod -v o-x /Users/Rax; sudo apachectl stop when I'm done.
    – orome
    Feb 8, 2014 at 15:08
  • And in any case, all that +x does for /Users/Rax is let others list the contents, right? So all I've done is let people see what everyone knows is there anyway (the standard Mac folders). Or can they browse further down into my files that would have been possible with -x?
    – orome
    Feb 8, 2014 at 15:10
  • Yes, but you didn't need to worry about readability of files under there when you had -x, so it is not really something I would call harmless.
    – covener
    Feb 8, 2014 at 15:17
  • 1
    I think that's right, but probably not 100% reliable to keep someone out (e.g. if you new more than the filename, without the ability to look at its directory). Preferrably the stuff you expect to be unreadable is actually unreadable, but on a system you mostly trust you might just be relying on the perms on $HOME
    – covener
    Feb 8, 2014 at 15:25
  • 1
    If /Users/Rax is drwx-----x, /Users/Rax/subdir was drwx------, then other users that cannot guess the name "subdir" can't do anything at all with it; other users that can guess/know the name subdir can see the folder's properties (e.g. its permissions) but not see into it at all. If subdir was drwx-----x, others who know/can guess the name "subdir" will be able to interact with files/subfolders only if they know/can guess their names. If subdir was drwx---r-r, others who know/can guess the name "subdir" will be able to see the names of items under subdir, but not interact with them. Feb 8, 2014 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.