In at least php-5.3 (linux-2.6.38.6) a process owned by apache could make a link() in a directory owned by apache, to a file owned by webmaster to which it had group read permissions. In php-7.0 (linux-4.13.16) that results in a "permission denied". Either the target file must be owned by apache or one must use copy() instead (so that ownership changes to apache).