Thanks Chris,
FreePBX is most certainly in use so unfortunately changing the common php folder ownership is not an option as it would break that installation.
OTOH, you gave me the idea that lighttpd can run as a different user by inserting the following values in /etc/lighttpd/external.conf. The external.conf file is outside the control of pi.hole, therefore modifications to that file will not be overwritten by pi.hole updates.
The following procedure will run lighttpd as the 'asterisk' user and group so that lighttpd can access the php sessions folder which is also being used by apache2 for the FreePBX application which is already running as that user.
Obviously, if the need arises, you could replace that with any other valid user:group.
/etc/lighttpd/external.conf
server.username := "asterisk"
server.groupname := "asterisk"
(note the colon before the = sign means the value replaces the original "www-data" value in lighttpd.conf)
There are a number of folders which also need changing:
[edit 08/10/2022]
It has been discovered that the owner:group for the lighttpd folders will be reset to www-data by system.d on every restart which is incovenient. But we can modify system.d behaviour for lighttpd as follows.
Remember, in my case the username is 'asterisk' so you should substitute that with your own username as needed.
Navigate to /usr/lib/tmpfiles.d/lighttpd.tmpfile.conf and open with your favourite editor to change every instance of www-data to your username (in my case 'asterisk') and save.
d /run/lighttpd 0750 asterisk asterisk -
d /var/log/lighttpd 0750 asterisk asterisk -
d /var/cache/lighttpd 0750 asterisk asterisk -
d /var/cache/lighttpd/compress 0750 asterisk asterisk -
d /var/cache/lighttpd/uploads 0750 asterisk asterisk -
(note the last line is empty)
Then run the following command in the console:
chown asterisk:asterisk /var/www/html
Also, the /etc/sudoers.d/pihole file must be commented / changed to:
# Pi-hole: A black hole for Internet advertisements
# (c) 2017 Pi-hole, LLC (https://pi-hole.net)
# Network-wide ad blocking via your own hardware.
#
# Allows the WebUI to use Pi-hole commands
#
# This file is copyright under the latest version of the EUPL.
# Please see LICENSE file for your rights under this license.
#
# www-data ALL=NOPASSWD: /usr/local/bin/pihole
asterisk ALL=NOPASSWD: /usr/local/bin/pihole
[/edit]
Remove user 'www-data' from all supplementary groups:
Depending on the use case, replace '' with a comma delimited list of
the subgroups which it needs to remain a member of.
usermod -G '' www-data
add 'pihole' as a supplementary group for asterisk
usermod -G pihole asterisk
Now, the result of $cat /etc/group | grep pihole :
pihole:x:994:asterisk
Finally, reboot the machine so that system.d will set the correct permissions for the lighttpd folders.
The pihole log now works as expected in the user interface with the correct permissions.
[Edited 02/10/2022 and 08/10/2022 to reflect the conclusions of the discussions below]