I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep owner www-data or apache (Depends on my web server user) for my web application directory. All directories should have 755 and all files should have 644. Files with 644, Directory with 755 and owner of web application directory (recursive) is root or ubuntu, this looks good to me but my yii application is not able to create files in runtime and assets so I am not able to login as well as users are not able to upload files in upload directories.
If I give 777 recursive to uploads directory, it starts working fine but an intruder can upload a malicious file in it and all files are 777 so he can simply remove all of them.
If I give 777 to folder only, not the files then users are not able to modify uploaded file, that is one of functionality, so functionality does not work, for security purpose it is fine.
If I make owner to www-data of uploads directory recursive 755, it means user can upload files, modify files because www-data has read write permission for the directory and the content but intruder also have same permission for its malicious file. In this case, he can also remove all files.
Summary If I keep 755 for all files and 644 for all files with owner www-data of web application directory recursively. All works well, I do not need to give 777 to uploads, runtime or assets, it can create files inside these directories when user uses web application but an intruder can also create php files in these directories with owner of www-data that means, he has also full modify permission to all files of all directories. I do not want to handle this in apache to make execution of php files forbidden inside uploads. For different web applications, this name is different and many applications use multiple directories for upload. I do not want to deny all for php files of uploads folders. There should be correct permissions which could handle this better.