Question

I’m building a system where different users can upload their custom php modules. The system is based on a custom MVC framework written in PHP and deployed on Linux.
When a user logges in, his modules will be loaded by the system core. The system core is shared between all modules.

My problem is, how to restrict USER modules from messing with the core. Eg. unlinking files, and similar. Can I prevent them from doing that with file permissions?

Answer 1

Hopefully, each user of your system will have a different user account on your server. If they don’t, it will be terribly hard to keep them from deleting each others data.

I’ll assume you’re working on some flavour of unix server.

• Create one user who owns the MVC system core. This is the admin user. I’ll call this user mvc-admin.
• Create a group which will allow access to the system core. I’ll call this group g-mvc-access in this answer.
• do chown -R mvc-admin:g-mvc-access /path/to/mvc-system-root. Now the files are all owned by the admin user, and in the access group
• do chmod -R g+r-w /path/to/mvc-system-root. Now the group can read, but not write, all the files under the MVC system root.
• Add all your users accounts to the group g-mvc-access.