Allow all group members to create directories and files

If you want to create a file as a specific user and group without using chown, you can use sudo and specify the user and group:

sudo -u \#49 -g \#58 touch /tmp/something

Note that the user you specify must have permission to write to the directory where you attempt this.

Or, you can start a shell as the current user, with the group set to something else:

sudo runuser "$USER" -g somegroup

I tried this on a Vagrant box with success:

[vagrant@localhost ~]$ sudo runuser "$USER" -g floppy
[vagrant@localhost ~]$ touch testfile
[vagrant@localhost ~]$ ls -l testfile
-rw-r--r--. 1 vagrant floppy 0 Nov  9 15:57 testfile
[vagrant@localhost ~]$ 

This is despite the "vagrant" user not being part of the "floppy" group.

Apache runs as a non-privileged user known as www-data in Debian distros for quite a very good reason: security.

It is considered a good security practice when dealing with daemons giving up privilege rights, avoiding as much as possible to create configuration files or data files with the ownership of the non-privileged user that runs the daemon - as such, if the Apache user is compromised, the attackers will have a much more hard time to mess around things or deface a site.

As possible, I recommend to create sites with different users, and to give read rights to the www-data group only; and to have only write access to www-data in directories that really need them. However even this can be avoided using mod-ruid2.

mod-ruid2 allows actually to run each site/vhost with their owner, and dealing with the security model of pages is much easier. It takes out the necessity of creating world writable directories. It also guarantees that in case of a compromise of one vhost, the attacker is not able to plant malware in the other vhosts.

mod-ruid2 is also advised for people with a hosting model, and we use it here to run a few hundreds sites, with quite success.

Unfortunately, the documentation about mod-ruid2 is a bit scant, and I had to write a more elaborate post to describe it here in Unix and Linux.