As the question said: How do I remove the _www user form the everyone group?

Background: I am trying to lock down PHP to my web directory. PHP runs under the _www user. My solution is to only give read permission to the web directory, but since _www is part of the everyone group it is become a big hassle.

enter image description here

  • Can you explain how the group everyone is a hassle? It mainly exists as a group identified in access control entries which deny the current user belonging to the group everyone from unlinking directories. – fd0 Jul 2 '18 at 15:32
  • @fd0 Long story short, currently using injection like /./././ as user can get out of the web directory and access the entire file system. If _www doesn’t have permission outside of the web directory then it’s not a problem because they will get a Forbidden header. Unfortunately, Everyone has access to some files in the user home folder therefore _www can access these folders. I don’t want to remove the everyone group because I want others to be able to access it. “A hassle” because I would be required to add every user individually instead of using the everyone group. – JBis Jul 2 '18 at 15:56
  • @fd0 Any ideas? – JBis Jul 2 '18 at 19:08
  • 1
    Are you aware that Apple uses the name everyone instead of others in the last traditional permission class? The classifications in traditional file permissions would be user/owner, group, then others. Apple has used others, everybody and everyone , depending on the OS version. – fd0 Jul 2 '18 at 19:37
  • @fd0 I wasn't but now I am aware :) But how does that change anything? – JBis Jul 2 '18 at 19:39

Here's what I have in my /etc/group file:
This means there's no user in everyone group, and _devicemgr and _teamserver are in group _www

If you have _www user in everyone group (ie in everyone line), you have to remove it from everyone group (the second line)

user needs to login to see effect. Reboot is easyer.

  • I have _www:*:70:_devicemgr,_teamsserver & everyone:*:12:. According to Directory Utility, everyone group is calculated by the system. – JBis Jul 2 '18 at 13:43
  • So _www is NOT in everyone group. You can't remove it. – Noury Jul 2 '18 at 13:47
  • It is in the everyone group. Check out this answer/script : superuser.com/a/395738 – JBis Jul 2 '18 at 13:48
  • Go back to your initial need. What gives the command "ls -l" (in a terminal) on one of your web directories ? – Noury Jul 2 '18 at 13:53
  • I don't think you understand. There are many folders in which everyone has read access. This includes _www. I don't want _www to access, therefore I need to remove _www from the everyone group – JBis Jul 2 '18 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .