What permissions / ownership to set on PHP Sessions Folder when running FastCGI / PHP-FPM (as user "nobody")?

The correct permissions for us where

chown -R nobody:nogroup /var/lib/php/session

as php-cgi runs as nobody, even though NGinx runs as user nginx

If you use nginx you might run into this when running a system update.

Sometimes when you update the system, the group of /var/lib/php/session is changed to apache.

Try executing sudo chgrp nginx /var/lib/php/* instead of setting permissions to 777 which is a bad practice.

That worked for me at least.

Use /etc/php.ini session.save_path directive.

A temporary solution is to set the permissions of /var/lib/php/session to 777 - I have a feeling that's not the "best practice" though.

"If you leave this set to a world-readable directory, other users on the server may be able to hijack sessions by getting the list of files in that directory. "

I had to create folder with 0700 rights in /var/lib/php/session for each php-fpm pool.

Owner of this folder is user and group from php-fpm pool.

And /var/lib/php/session now 0777.

I think this method is most secure. Only php-fpm pool user will see this sessions.