I do not believe my scripts should execute when I call them from the browser if apache's www-data does not have permission..

1. The scripts are php
2. Owner is root
3. Owner is the only one with write + execute permissions
4. the scripts still run when called from a browser outside
the local network.
5. Standard apache2 and php install on debian wheezy

Is it possible that apache is starting under the root user account?

To diagnose such a situation, where so I start? Can I monitor what user accesses a file? what tools can help me trouble shoot.

Is it at all possible that apache opens the file reads and parses it ignoring the execute permissions? Seeing as a php file can make changes to it's neighbors I do not feel secure with this even though it does not have permission to make changes. To disable a script in a web accessable directory would it be appropriate to deny read permissions.

PHP scripts do not require execute permission to be parsed by the web server.

In general, if you don't want people with access to the URL to see something, DON'T put it in the web server accessible tree!

Thank you, after all consideration I do feel secure with this.

I however did consider the possibilty of signing all my php scripts and implimenting a way in apache to verify this signature so if by chance a rogue script finds it's way into my webdirectory my file verification module would also have to be compromised to allow it to be parsed. Thats all, this solves my paranoi --

You could put all scripts on a read-only mount ...

I like that idea, I would like to add: One could give www-data quota restrictions in case some corruption some how happens on the loopmounted image you have enough space to recover.

Is it some how possible instead of having to remount every time you make changes , and instead mount the image twice where: one is mounted in a seperate system with write permissions, I do not think it would cause any race conditions or access issues as one is read only. I would be willing to guess that errors on mounting an image twice would emerge in the process, if one mount is read only though I would erge that they only be warnings.