webmin/sqlite/help/acl_info.html

<header>SQLite module access control</header>

These settings control which database files a Webmin user can open and what
the user can do with them. They do not override the filesystem permissions
of the selected Unix user.

<p>For <b>Allowed database directories</b>, enter one absolute directory per
line. The module allows files in those directories and their subdirectories.
Use <tt>$HOME</tt> for the selected Unix user's home directory. Paths outside
the listed directories are rejected. In root mode, <tt>$HOME</tt> refers to
the Unix account whose name matches the Webmin user. SQLite 3.39 or later is
required for a restricted list because it prevents symbolic links in any path
component from escaping these directories. A list containing <tt>/</tt> does
not restrict database paths and does not need this check. This requirement
applies to the SQLite library used by <tt>DBD::SQLite</tt>, which may differ
from the system <tt>sqlite3</tt> command. Unix permissions still apply, but they
do not enforce this module's directory list.</p>

<p>The row and table permission enables forms for editing rows and changing
schemas. The file creation permission allows new files in writable allowed
directories. The module offers file creation only when the user can also add
a table through a form or SQL.</p>

<p><b>Execute SQL statements</b> permits one direct SQL statement at a time.
This is a separate write permission: SQL may change the current database when
its file and directory are writable. The module blocks attached databases,
extensions, and SQL operations that access other files.</p>

<p><b>Unix user for database access</b> selects the filesystem identity used
by the module. Root normally bypasses file ownership and permissions. A
matching or specific Unix user limits access to files that account can read
and write.</p>

<footer>