Should all files/folders in an installation be owned by the web server user?

Question

As in the title, should all files/folders in a Drupal 8 installation be owned by the web server user, e.g. the default www-data user for Apache?

As far as I know, the answer is yes at least in principle, so that all files/folders should have www-data as both owner and group, and more so because of logistics/minimalism/ease of management.

Is that correct or are there other considerations?

Answer 1

Securing file permissions and ownership is the canonical reference for this topic, and is still relevant for Drupal 8.

If we are going under the assumption where we are talking about who owns these files, then we can also assume you have root on the machine and configure the entire environment the way you need.

Having "www-data" (or equivalent) own the entire DOCROOT of any website is an unnecessary security attack surface. If there is a security breach (either through code or the webserver), then an attacker can change code on the site.

If you have root, then you don't need to explicitly use the UI for uploading or updating modules. This is the only real reason to have www-data own the site.

The linked article has all of the details, but I always recommend

• A normal user owns everything in DOCROOT, except for sites/default/files (or wherever your files are for your sites), the private, and tmp directories (and if possible private and tmp outside of DOCROOT).
• Apache runs with a proper umask so that group write is on for files
• The data directories have 2775 permission on them, so group ownership is retained
• Your normal users is also in the www-data group, so drush / drupal console work as expected

The script in the linked article handles most of this; I usually create custom ones for my sites that do the same thing.