I'm hosting several WordPress sites on a LEMP VPS.
- Each site has its own Wordpress install (located under
/srv/http/domain/wordpress), its own user account (site-user) and its own php-fpm pool running as site-user.
- Nginx is running under the http account and all files under
/srv/http/domain/wordpresshave site-user:http ownership with 0640 (files) and 2750 (directories) permissions.
So, each user has full RW access to their own files/directories, but no access to other site's files/directories. Nginx has R-only access to every site's files/directories.
I'm using the setgid bit to force new directories created under
/srv/http/domain/wordpress to inherit the http group so Nginx has read access to these. This works as expected when files are created via SFTP.
This seems sane to me and I can update plugins, themes and WordPress successfully through the wp-admin interface. However, anytime I execute a task that requires WordPress to create new files/directories -- basically anytime I install or update a plugin/theme or update Wordpress itself -- the resulting file ownership is site-user:site-user. What I'd like is to have the newly created files/directories respect the setgid bit and create files/directories with site-user:http ownership so Nginx can read these files without my intervention.
I set the following in each site's wp-config.php file:
define( 'FS_CHMOD_DIR', ( 02750 & ~ umask() ) );
define( 'FS_CHMOD_FILE', ( 0640 & ~ umask() ) );
This forces the permissions to what I want but doesn't have any effect on ownership.
I've read this and this but the "solution" requires modifying PHP code to avoid using
move_uploaded_file() which is fine if you're writing your own PHP code, but I'm not going to start modifying WordPress PHP files. I'm not even certain this is the source of my issue.
Also, I understand I could loosen permissions and set them to 755 (directories) and 644 (files) so that Nginx could read files regardless of whether it had group ownership over them, but for security reasons I'm trying to avoid world-readable files on a shared server.
How to I control ownership of files created by WordPress/PHP?