One of my website pages (written in PHP) manipulates a MySQL database before starting a .jar archive in background, with the following command :
nohup java -jar myJar.jar > /dev/null &
This jar creates a text file in a folder (the current one or subfolders). For my Java program to write file, I have to set the w (write) permission to a (all users) on the www folder (or one of its subfolders).
Based on what I read, one of the solutions would be to give the write permission only to www-data, which would be Apache. Howerver I cannot see how it is more secure than a 777 chmod, because a hacker would always have the permission to write through his browser.
Do you know a solution which would :
- Make my server as safe as possible.
- Allow my Java program (launched by PHP) to create and modify files on the server.
run your java program as a deamon with its own user with a privelege to edit that specific folder.
Set it to monitor a file or database to see if it needs to run and do its thing. Then when your php script needs it just modify the file/database.