Secure File Permissions

Secure file permissions

Advanced (server access needed).

The web server user (www-data on Ubuntu) runs AVideo. If it can change AVideo's own files, a security problem in any part of the site could be used to change those files permanently. The safe setup is:

• AVideo's files (the code, .git, plugin, vendor, the Encoder code) belong to root. The web server can read them, not change them.
• The web server can write only where AVideo saves data: the videos folder, plus a few folders listed below.

New installations made with the Ubuntu 24.04/26.04 guide already use this setup. Use this page on an older server, or on one where someone ran chown -R www-data on the whole AVideo folder.

Who can write where

Folder	Owner	Why
Everything in /var/www/html/AVideo not listed below	root	Code. Changed only by git pull and by you.
videos/	www-data	Uploads, images, cache, logs and configuration.php
Encoder/videos/ (if you have your own Encoder)	www-data	Files being converted
plugin/YPTSocket/nodeSocket/	www-data	The live-update (socket) server downloads its new versions here
plugin/WebRTC/ (only this folder, not its files)	www-data	Only if you use the WebRTC plugin (go live from the browser): it copies its server program here
plugin/Backup/backupDir/	www-data	Only if you use the Backup plugin with its default folder

Nothing else needs to be writable. With this setup:

• Plugin upload in the Plugins page does not work, on purpose: the web server could otherwise replace any plugin. Install and update plugins from the server instead (Install a plugin, Method 2). If the upload window says You need to make the plugin dir writable before upload, do not run the command it shows.
• Uploads, encoding, live, the Scheduler task, database updates and plugin settings keep working: they write only to videos/ and to the database.

Before you start

1. Make a backup: see Back up and restore AVideo.

2. Save the current owners and permissions, so you can undo the change. This does not include the videos folders, which are not changed:

   sudo apt install -y acl
   cd /var/www/html/AVideo
   sudo find . \( -path ./videos -o -path ./Encoder/videos \) -prune -o -print | sudo getfacl -P - | sudo tee /root/avideo-permissions-before.acl > /dev/null

Replace /var/www/html/AVideo everywhere on this page if AVideo is in another folder (it is the systemRootPath value in videos/configuration.php).

Apply the secure setup

Paste this block. It gives AVideo's files back to root and lets everyone read them (as a fresh git clone does), without touching anything inside videos or Encoder/videos. Then it gives the web server only the folders in the table:

cd /var/www/html/AVideo
sudo find . \( -path ./videos -o -path ./Encoder/videos \) -prune -o -exec chown -h root:root {} +
sudo find . \( -path ./videos -o -path ./Encoder/videos \) -prune -o ! -type l -exec chmod u+rwX,go+rX,go-w {} +
sudo chown www-data:www-data videos
sudo mkdir -p plugin/YPTSocket/nodeSocket
sudo chown -R www-data:www-data plugin/YPTSocket/nodeSocket
if [ -d Encoder/videos ]; then sudo chown www-data:www-data Encoder/videos; fi

If you use the WebRTC plugin, also paste:

cd /var/www/html/AVideo
sudo chown www-data:www-data plugin/WebRTC
sudo find plugin/WebRTC -maxdepth 1 \( -name WebRTC2RTMP -o -name WebRTC2RTMP.json \) -exec chown www-data:www-data {} +

If you use the Backup plugin with its default folder, also paste:

sudo mkdir -p /var/www/html/AVideo/plugin/Backup/backupDir
sudo chown -R www-data:www-data /var/www/html/AVideo/plugin/Backup/backupDir

Check it

1. List everything the web server can still change outside the videos folders:

   sudo -u www-data find /var/www/html/AVideo \( -path /var/www/html/AVideo/videos -o -path /var/www/html/AVideo/Encoder/videos \) -prune -o -writable -print

   It must show only the folders from the table (plugin/YPTSocket/nodeSocket, and plugin/WebRTC or plugin/Backup/backupDir if you added them). This command only reads; it changes nothing. You can run it at any time, for example after an update.

2. Open the site, play a video, upload a short video and check that it is converted.

Updates

Update as usual (Update AVideo). sudo -u "$(stat -c %U .)" git pull now runs Git as root, the owner of the folder. New files from the update belong to root too, so nothing needs to be fixed afterwards. The database and plugin updates are done in the browser or with sudo -u www-data php updatedb.php, as that page explains; they change only the database.

Install and update paid plugins with Method 2, and run commands that a plugin page shows you (for example unzip for User_Location) with sudo.

Undo

To go back to the owners and permissions saved in Before you start:

cd /var/www/html/AVideo
sudo setfacl --restore=/root/avideo-permissions-before.acl

Problems

Problem	What to do
git pull says "Permission denied" or "detected dubious ownership"	Run it as shown in Updates, with sudo -u "$(stat -c %U .)".
The upload window says You need to make the plugin dir writable before upload	Expected with this setup. Install the plugin with Method 2.
Going live from the browser stopped working	Run the WebRTC block above.
The Backup plugin says "Your backup directory must be writable"	Run the Backup block above.
You want someone to do this for you	Use a service from the marketplace.