Home directory for the www-data user?

As I understand the www-data user is the user that owns the apache service.

From the /etc/passwd file I have:

www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

So the home dir for www-data is: /var/www but if I check the permissions for that folder I get:

/var/www $ ll
total 12
drwxr-xr-x 3 root root 4096 Mar 20 19:42 ./
drwxr-xr-x 12 root root 4096 Mar 20 19:42 ../
drwxr-xr-x 2 root root 4096 Mar 20 19:42 html/

So it appears that root owns that folder. Why is it not the www-data user that owns the /var/www directory (its home directory)?

1 Answer

There's no reason for the webserver to able to write to that directory by default. The administrator should decide which directories and files the webserver should be able to modify, and grant permissions on those accordingly. Having /var/www be owned by root is a safe and secure default.