Why is group ownership with rwx permissions not enough?

Question

Running PHP 5.4 and Apache2 on Debian 7, with apache configured to use user www-data.

I'm trying to figure out why Wordpress cannot modify files in its directory when it has group ownership with full permissions, and seems to only work if it has user ownership.

Allow me to illustrate :

---

Case 1

• Set User to root and Group to www-data:

  chown -R root:www-data /var/www/site-dir/wordpress-dir/

• Set Permissions to read, write and execute for both user and group.

  chmod -R u=rwx,g=rwx /var/www/site-dir/wordpress-dir/

• Current ls -l output of the Wordpress directory:

  drwxrwsr-x 5 root www-data 4096 Jul 11 15:20

• Outcome: When trying to delete a plugin, Wordpress claims it does not have access:

  

Case 2

• Permissions are identical to 1, but user is set to www-data:

  chown -R www-data:www-data /var/www/site-dir/wordpress-dir/

• Outcome: Wordpress is now able to delete the plugin:

  

---

Question

I'm trying to understand what's going on here. Why does the user have to be www-data, even when using www-data as group it has full permissions?

With my (limited) understanding of linux permissions I would assume that, since the apache process running Wordpress is using the www-data user, it would have complete access to do whatever it needs to in case 1, because the group is recursively set as www-data, and group permissions are recursively set to read, write and execute.

Why does the user need to be www-data for this to work?

Answer 1

duplicate? At least you can find lots of (possible) explainations and (possible) solutions here: https://stackoverflow.com/questions/640409/can-i-install-update-wordpress-plugins-without-providing-ftp-access

Answer 2

This is because in the WP_Filesystem method function in wp-admin/includes/file.php it determines the update method automatically if you have not defined the FS_METHOD in your wp-config.php.

if ( $wp_file_owner !== false && $wp_file_owner === $temp_file_owner ) 

It checks to make sure a new file created by the script has the same owner as the file.php script. However, if FS_METHOD is defined, all these checks are skipped and it basically skips down to the return call.

Another workaround is changing the ownership of file.php to be owned by your webserver. But I feel like defining the FS_METHOD constant is a better solution.