APACHE_WEBROOT is always writable. Do we want that?

[toarni]

Looking at this line:

docker-base-images/php74/php74/opt/bootstrap.sh

Line 14 in 6d4d881

ensure_dir "$APACHE_WEBROOT"

We also have that in the other images as well.
Idea was, that the APACHE_WEBROOT is always present.
But, by using the function ensure_dir this dir is also writable.
I can not imagine, why we want to have that.

@Neunerlei Was that made writable on purpose?

[Neunerlei]

Hey @toarni,

no, there is no reason for that, and I agree that that should be changed out asap.

I would suggest changing it to ensure_dir "$APACHE_WEBROOT" u=rX,g=rX,o-rx to set the permissions, for the owner, but without the write permission.

However 1:
It seems that ensure_dir() also has a bug. If you look at the parameters in the documentation, it should be able to receive permissions to set, but it does simply ignore them:

docker-base-images/php74/php74/conf/.bashrc

Line 14 in 6d4d881

ensure_dir() {

That should be easy to fix, tho. I could create a PR if you want to.

However 2:
While the issue at hand can easily be fixed, lets quickly think about the implications 🤔.
If we make the webroot no longer writable, and lets say, we have a project that depends on something like /var/www/html/var to be writable, can we ensure, that any of the projects that use the base images, having their permissions.sh set up correctly?
Otherwise, changing that will possibly kill those projects when they are rolled out with the change applied to them. How do we think about that?

P.S. Sorry for the delay, the notification landed in the SPAM folder...