As I understand the www-data user is the user that owns the apache service.
From the /etc/passwd file I have:
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin So the home dir for www-data is: /var/www but if I check the permissions for that folder I get:
/var/www $ ll total 12 drwxr-xr-x 3 root root 4096 Mar 20 19:42 ./ drwxr-xr-x 12 root root 4096 Mar 20 19:42 ../ drwxr-xr-x 2 root root 4096 Mar 20 19:42 html/ So it appears that root owns that folder. Why is it not the www-data user that owns the /var/www directory (its home directory)?
1 Answer
There's no reason for the webserver to able to write to that directory by default. The administrator should decide which directories and files the webserver should be able to modify, and grant permissions on those accordingly. Having /var/www be owned by root is a safe and secure default.
