Cursor rule

1---
2description: Drupal file permissions security standards
3globs: *.dockerfile, *.sh, docker-compose.yml, Dockerfile
4---
5# Drupal File Permissions Security
6 
7Standards for securing Drupal file permissions in Docker environments and production servers, ensuring proper security while maintaining functionality.
8 
9## Rule Details
10 
11- **Name:** drupal_file_permissions
12 
13- **Description:** Enforce secure file permissions for Drupal sites/default directory and critical files
14 
15## Filters
16- file extension pattern: `\\.(dockerfile|sh|yml)$`
17- file name: `^Dockerfile$|^docker-compose\\.yml$`
18- content: `(?i)chmod|chown|drupal|settings\\.php|services\\.yml`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `chmod\\s+(?!755)\\d+\\s+[^\\n]*sites\\/default(?![^\\n]*files)` – sites/default directory should have 755 permissions (read-only for group/others)
23  - pattern `chmod\\s+(?!444)\\d+\\s+[^\\n]*settings\\.php` – settings.php should have 444 permissions (read-only for everyone)
24  - pattern `chmod\\s+(?!444)\\d+\\s+[^\\n]*services\\.yml` – services.yml should have 444 permissions (read-only for everyone)
25  - pattern `chmod\\s+(?!755)\\d+\\s+[^\\n]*sites\\/default\\/files` – sites/default/files directory should have 755 permissions with proper ownership
26  - pattern `chown\\s+(?!www-data:www-data)[^\\s]+\\s+[^\\n]*sites\\/default\\/files` – sites/default/files should be owned by the web server user (www-data:www-data)
27 
28## Suggestions
29- Guidance:
30## Drupal File Permissions Security Best Practices
31 
32### 1. Critical File Permissions
33- **sites/default directory**: 755 (drwxr-xr-x)
34- **settings.php**: 444 (r--r--r--)
35- **services.yml**: 444 (r--r--r--)
36- **settings.local.php**: 444 (r--r--r--)
37- **sites/default/files**: 755 (drwxr-xr-x)
38- **sites/default/files/** (contents): 644 (rw-r--r--) for files, 755 (drwxr-xr-x) for directories
39 
40### 2. Ownership Configuration
41- **Web root**: application user (varies by environment)
42- **sites/default/files**: web server user (www-data:www-data)
43 
44### 3. Implementation in Dockerfile
45```dockerfile
46# Set proper permissions for Drupal
47RUN mkdir -p /app/${WEBROOT}/sites/default/files && \
48    chown www-data:www-data /app/${WEBROOT}/sites/default/files && \
49    chmod 755 /app/${WEBROOT}/sites/default && \
50    chmod 444 /app/${WEBROOT}/sites/default/settings.php && \
51    chmod 444 /app/${WEBROOT}/sites/default/services.yml && \
52    find /app/${WEBROOT}/sites/default/files -type d -exec chmod 755 {} \\; && \
53    find /app/${WEBROOT}/sites/default/files -type f -exec chmod 644 {} \\;
54```
55 
56### 4. Permission Fix Script
57Create a script at `/app/scripts/custom/fix-drupal-permissions.sh`:
58```bash
59#!/bin/bash
60 
61# Exit on error
62set -e
63 
64WEBROOT=${WEBROOT:-web}
65
66echo "Setting Drupal file permissions..."
67 
68# Ensure directories exist
69mkdir -p /app/${WEBROOT}/sites/default/files
70 
71# Set ownership
72chown www-data:www-data /app/${WEBROOT}/sites/default/files
73 
74# Set directory permissions
75chmod 755 /app/${WEBROOT}/sites/default
76chmod 755 /app/${WEBROOT}/sites/default/files
77find /app/${WEBROOT}/sites/default/files -type d -exec chmod 755 {} \;
78 
79# Set file permissions
80chmod 444 /app/${WEBROOT}/sites/default/settings.php
81[ -f /app/${WEBROOT}/sites/default/services.yml ] && chmod 444 /app/${WEBROOT}/sites/default/services.yml
82[ -f /app/${WEBROOT}/sites/default/settings.local.php ] && chmod 444 /app/${WEBROOT}/sites/default/settings.local.php
83find /app/${WEBROOT}/sites/default/files -type f -exec chmod 644 {} \;
84
85echo "Drupal file permissions set successfully."
86```
87 
88### 5. Verify Permissions
89```bash
90# Check file permissions
91ahoy cli "ls -la /app/${WEBROOT}/sites/default"
92ahoy cli "ls -la /app/${WEBROOT}/sites/default/files"
93 
94# Check Drupal status
95ahoy drush status-report | grep -i "protected"
96```
97 
98### 6. Security Considerations
99- Never set 777 permissions on any Drupal files or directories
100- Temporary files should be stored in private file system when possible
101- Use Drupal's private file system for sensitive uploads
102- Implement file access controls through Drupal's permission system
103- Consider using file encryption for highly sensitive data
104 
105## Metadata
106- Priority: high
107- Version: 1.2
108 
109 
110