By default "instances" that are created under LAMP2 run as the user (holding id) account "lamp". If you want to ensure that instances cannot access files from another instance it is possible to configure a multi-tenant environment where each instance runs as a different account/holding id. This provides more separation between instances, but does not guarantee complete isolation. If you have any security concerns about a particular instance, ensure that it is isolated to its own VM. Some use cases for using different ids is to separate a dev/test/prod instance or support multiple developers,but keep them isolated from accessing each other files.

The general steps involved:

1. treat instances that run as "lamp" as administrative instances that will have access to all files (useful if you want to use PHP shell to browse the system)
2. keep instance permits separate and utilize ".wdaccess" files that limit individuals to their particular instance

Known issues

• It is possible to create a top-level directory that is not accessible to the webdav process. In this case via the PHP shell you will need to do something like:

chgrp -R [problem directory]
chmod -R g=u [problem directory]

• The "fix-cgi" script does not work when using a "lampuserXXX" id (use PHP shell instead)
• Changing the "runas" user on an instance will reset all the group file permissions on an instance