About permission issues with LNMP

I usually do the NGINX environment when the following methods are generally used,
Nginx www user www Group,
PHP-FPM www user www Group,
Web site, a user www group, this time set the permissions are 775, in fact 755 is not used, because PHP-FPM and nginx no execution rights and reported 403, good, this time php-fpm can create a new pool with a user and WWW group to run, At this time php-fpm there is no 403 problem, then Nginx will be reported 403, because not read the directory, no permissions. You still have to have 775 permissions.

The problem is as follows:
1, this configuration actually exists in the previous virtual host era of the cross-site problem, that is, a station users can read B, because 775 permissions, they can even read and write. Is that right?
2, if Nginx run with root, it seems to solve the problem, that is, Nginx root,pph-fpm and site users correspond, so I heard nginx can not run with the root, specifically how do you get it? Please advise

Reply content:

I usually do the NGINX environment when the following methods are generally used,
Nginx www user www Group,
PHP-FPM www user www Group,
Web site, a user www group, this time set the permissions are 775, in fact 755 is not used, because PHP-FPM and nginx no execution rights and reported 403, good, this time php-fpm can create a new pool with a user and WWW group to run, At this time php-fpm there is no 403 problem, then Nginx will be reported 403, because not read the directory, no permissions. You still have to have 775 permissions.

The problem is as follows:
1, this configuration actually exists in the previous virtual host era of the cross-site problem, that is, a station users can read B, because 775 permissions, they can even read and write. Is that right?
2, if Nginx run with root, it seems to solve the problem, that is, Nginx root,pph-fpm and site users correspond, so I heard nginx can not run with the root, specifically how do you get it? Please advise

PHP can use Open_basedir to assist in isolating directories between individual users. Can only read their own, can not read other people's.

Nginx:
User www www;

PHP-FPM:
user = www
Group = www

Directory:
Drwxr-xr-x is 755.

