does Changing files ownership affect backups

basel

Hello,

We are planning to modify file permissions (e.g., for the mu-plugins directory) on all websites to prevent users from deleting or modifying these files. Could you confirm whether this change might impact the backup or restore functionality for these websites?

I have already performed tests for both backup and restore, and everything appears to be working correctly so far. I’d appreciate your confirmation or any considerations we should be aware of before implementing this change across all sites.

cPFence

basel

Yes, it can cause issues, but not always, it depends on the permissions you set. What exact permissions did you use in your tests?

basel

cPFence

    if ! chown -R root:root "$MU_DIR" 2>/dev/null; then
        echo "[ERROR] Failed to set ownership on $MU_DIR" >&2
        continue
    fi

    # Change directory permissions
    if ! chmod 775 "$MU_DIR" 2>/dev/null; then
        echo "[ERROR] Failed to chmod directory $MU_DIR" >&2
        continue
    fi

    # Change file permissions for PHP files only
    if ls "$MU_DIR"/*.php >/dev/null 2>&1; then
        if ! chmod 664 "$MU_DIR"/*.php 2>/dev/null; then
            echo "[ERROR] Failed to chmod PHP files in $MU_DIR" >&2
        fi
    fi

cPFence

basel

Setting ownership to root is not recommended by the Enhance team and may cause issues later on.

Nickske00

Backups run as the website user for security.

Found in the documentation, https://enhance.com/docs/backup-role/backup-logs.html So setting ownership to root is probably a bad idea. 😉

Adam

The backup will work if the directory is owned by root but readable by the user, however a restore would fail until you corrected the ownership. Both processes run as the website user rather than root.

8Dweb

Adam Ok, but the OP brings up an interesting point... in certain Agency type scenarios, you may indeed need to lock down the MU directory. What would be the best method for such a need?

basel

Adam
is there a work around that ? i want to make sure my backups are restored safely and also not to have my mu plugins altered with

adil

8Dweb

@cPFence Could suggest something 🤭

cPFence

adil @cPFence Could suggest something

Try changing the ownership of the wp-content/mu-plugins directory to root:root without altering permissions or files. This should block users from adding or removing MU plugins while still allowing backup and restore. We tested it on a staging site and it worked, but it needs verification in production.

GoSuccess

basel I think you could use this filter in your MU plugin: https://developer.wordpress.org/reference/hooks/show_advanced_plugins/

This won't stop them from changing the files in their mu-plugins directory, but at least they won't see them in the backend, so they won't know that MU plugins exist.

Adam

basel

If you want the customer to be able to restore the files in their home dir then they need write access to the files in their home dir. If you take away that access by making the files immutable or changing the ownership to root then the restore won't be possible but the backups should continue to work.

Why does the customer need control panel access? Is it to manage their email? If so, we have a feature request for a more granular access level that allows only email access. It might help with this use case.