is it safe for the Apache to be the owner of the session directory (php)

Question

Since I have upgraded to php 5.3 I have issues with the session GC.
Seems he can't access the directory which is owned by root, Although I see sessions are being created there.
Is it safe to change the ownership of that directory to the Apache?

Answer 1

Depends on the directory you are talking about. Changing the permissions of the /tmp directory isn't a good idea for example. When you are using a separate directory for just PHP session files you can change the ownership to the Apache user and group.

If you are hosting multiple users on the same machine you may want to look into running PHP as a separate user for each VirtualHost or set the session.save_path to a private directory for each VirtualHost. Otherwise users can read each others PHP session files because they are owned by the Apache user.

What issues are you experiencing with GC?