find commands should be run as root, or at least a user that has full access to the directory tree. You will need an additional check to verify access to the paths used in the find commands. This can be accomplished by running the command as the target user. Failures when running as a non-root user should be dealt with appropriately.
/srv/www with the appropriate directory or directories for your requirements. Change the user and group appropriately for other users. If the user belongs to multiple groups, you will need to add additional tests for the secondary groups. (In many cases just flagging files owned by the secondary groups may be sufficient.)
For a system where
apache runs as
www-data:www-data the following will find files which can't be read.
find /srv/www ! -type d ! \( -user www-data -perm -400 \) -a ! \( -group www-data -perm -040 \) -a ! -perm -004
The equivalent for accessible directories is:
find /srv/www -type d ! \( -user www-data -perm -500 \) -a ! \( -group www-data -perm -050 \) -a ! -perm -005
For directories that don't need to be listed use
1 instead of
5 in the above. Files with known names will be accessible, but auto-index generation won't be.
You may also want to ensure only a few files or directories can be written to. The following finds files and directories that can be written too.
find -L /srv/www \( -user www-data -perm -200 \) -o \( -group www-data -perm -020 \) -a -perm -002