scripts/entrypoint-fpm.sh

@@ -27,7 +27,17 @@ echo "Container memory: ${CONTAINER_MEMORY_MB}MB | PHP-FPM pm=${PHP_FPM_PM} max_
 mkdir -p /run/php-fpm/
 /usr/sbin/php-fpm -y /etc/php-fpm.conf
 chown -R $user:$user /home/$user
-chmod -R 755 /home/$user
+# Do NOT `chmod -R 755` the docroot here. /home/$user is the customer's
+# bind-mounted site directory; a recursive 755 on every start made every file
+# (wp-config.php included) world-readable AND executable, and reverted any
+# tighter permissions the customer had set. Apache (shared-httpd, or the
+# bundled httpd) runs as `apache`, not the customer, so it only needs to
+# traverse directories to serve static files. Normalise that and nothing else:
+# open the docroot itself, and add o+x to directories that lack it. Regular
+# files are never touched, so execute is never added and wp-config.php is
+# never loosened.
+chmod 755 /home/$user
+find /home/$user -type d ! -perm -o=x -exec chmod o+x {} +
 
 if [[ $environment == 'DEV' ]]; then
   echo "Starting Dev Deployment (FPM-only mode)"

scripts/entrypoint.sh

@@ -37,7 +37,17 @@ fi
 /usr/sbin/httpd -k start
 /usr/sbin/php-fpm -y /etc/php-fpm.conf
 chown -R $user:$user /home/$user
-chmod -R 755 /home/$user
+# Do NOT `chmod -R 755` the docroot here. /home/$user is the customer's
+# bind-mounted site directory; a recursive 755 on every start made every file
+# (wp-config.php included) world-readable AND executable, and reverted any
+# tighter permissions the customer had set. Apache (shared-httpd, or the
+# bundled httpd) runs as `apache`, not the customer, so it only needs to
+# traverse directories to serve static files. Normalise that and nothing else:
+# open the docroot itself, and add o+x to directories that lack it. Regular
+# files are never touched, so execute is never added and wp-config.php is
+# never loosened.
+chmod 755 /home/$user
+find /home/$user -type d ! -perm -o=x -exec chmod o+x {} +
 
 if [[ $environment == 'DEV' ]]; then
   echo "Starting Dev Deployment"