I know this is a very old question, but I wanted to add a good solution with some detailed explanations. You will need to complete two statements on similar Ubuntu systems, and then it works like a charm.
Linux permissions can be represented by three digits. The first digit defines the permission of the file owner. The second figure is the rights of a certain group of users. The third digit defines permissions for all users who are not the owner or member of the group.
It is assumed that the web server will run with an identifier that is a member of the group. The web server should never start with the same identifier as the owner of the files and directories. Ubuntu runs apache under id IDs. This identifier must be a member of the group for which permissions are specified.
To provide the directory to which you want to change the contents of files, the appropriate rights, execute the statement:
find %DIR% -type d -exec chmod 770 {} \;
. This would mean in the question that the permissions for the% ROOT% / database directory need to be changed accordingly. Therefore, it is important not to have files inside this directory that should never be changed or deleted. That is why it is recommended to create a separate directory for files whose contents need to be changed.
Read permissions (4) for the directory mean the ability to collect all files and directories with their metadata in the directory. Write permission (2) gives permission to change the contents of the directory. This means that you add and delete files, change permissions, etc. Permission to execute (1) means that you have the right to go to this directory. Without the latter, it is impossible to go deeper into the catalog. The web server needs read, write, and execute permissions when the contents of the file change. Therefore, the group requires the number 7.
The second statement is in the OP question:
find %DOCUMENT_ROOT%/database -type f -exec chmod 760 {} \;
Reading and writing a document is required, but the execution of this file is not required. 7 is provided to the file owner, and 6 to the group. The web server does not need to have permission to execute the file in order to modify its contents. These write permissions should only be specified in files in this directory.
All other users should not receive any permissions.
For directories that do not require changing its files, group permissions are permissible 5. Permission documentation and some examples:
https://wiki.debian.org/Permissions
https://www.linux.com/learn/tutorials/309527-understanding-linux-file-permissions
http://www.linux.org/threads/file-permissions-chmod.4094/