In Magento 2 we have a new filesystem permissions guidelines.

Reading this link I understand that Magento requires php user inside www-data group.

What I do not understand is why static filesystem permissions are generated using 0770 instead of 0750.

With this kind of permissions another user in the same server and belonging to www-data group will be able to modify all my files.

Isn't it dangerous? Is there any reason for this?

I know the Magento 2 approach is to always have a dedicated VM and I agree with it, but I do not see any good reason for this permissions settings.

  • We recommend 750 permissions in production mode, where you want security locked down. In development, when you're presumably inside a firewall with no outside access, it might not be necessary. Feb 25, 2016 at 23:36
  • I've seen this is hardcoded in the Magento core, what I'm asking is the reason. I think there should be one. Feb 26, 2016 at 12:04
  • Security. We have had multiple attacks where malicious code was written to a directory, either the root or pub. It's harder to carry out an attack if files aren't writeable or executable. Magento hard-codes permissions for both developer and production modes; AFAIK, default is the same as developer. Feb 28, 2016 at 1:25
  • So why 770 instead of 750? Feb 28, 2016 at 14:14
  • 1
    Depends on the mode you're in. Feb 28, 2016 at 15:06