hsleisink/hiawatha — pull request #10 by BuGlessRB (2013-07-08 11:09:12+00:00)
Title: Lock down security issues regarding chmod/chown/setuid.

IMO, a daemon (webserver) should not be chowning/chmoding/mkdiring in general. That should be reserved for installation scripts or administrators which lock down permissions for directories and files.
If files need to be created, it needs to be done using the real uid/gid from the process. Anything else would be confusing (and therefore opens the door to security leaks) to seasoned UNIX administrators.