This is related to, but not a duplicate of, CiviCRM rebuilding templates_c with permissions.
I am using civicrm 5.1.2 / Drupal 7 / Apache / Linux.
It is best practice not to let
www-data own files in the Drupal tree. By the principle of least privilege, the web server should not be allowed to write to directories that it does not need to write to. And obviously someone needs to be able to write to them so that you can log on and upgrade and so on.
So I set up the permissions as suggested here . User
jane has ownership of all the files and directories apart from the
files directory, which is owned by
This does not work with CiviCRM and drush.
When you do a
drush cc or
drush cvupdb in the command line, as
ConfigAndLog directories get files added to them with owner
jane and group
www-data (I have set the setgid bit in order to ensure that the group remains
www-data) and they get created with group write permissions. That is all well and good - the web server has write permissions via the group, and then is able to update the files when it needs to.
But when the web server creates the files itself, it creates them with
www-data as both the group and the user. This is of course all it can do. However, it does not set group write permissions. That means that the next time
jane logs on to do something from the command line that writes to those directories, she can't.
What do you suggest?