Permissions: What's the right way to give Apache more user permissions?

The first-best thing would be to put the script in a standard location (such as /usr/local/bin) where the web server would have sufficient permissions to execute it.

If that's not an option, you can change the group of the script using chgrp groupname path, then make it executable for the group by chmod g+x path. If the _www user isn't already in that group, add it to the group by usermod -aG groupname _www.


To answer your question, it's better to give the _www group permission to execute your scripts.

Use an ACL to extend the permissions on your *.sh scripts to allow a user in the _www group execute privilege:

cd /Path/To/Custom
setfacl -m g:_www:rx *.sh

Also check each directory component of /Path/To/Custom & verify that apache has permission to access (i.e. 'see') the scripts in /Path/To/Custom:

ls -ld /Path
ls -ld /Path/To
ls -ld /Path/To/Custom

Each directory component above should grant apache a minimum of execute permission apart from the final component (Custom) where apache needs both execute & read permission. e.g. if all the directory components above have other permissions of r-x then apache has all the access rights it needs to find your scripts in the Custom directory.