I just make sure everything that touches my media files runs under the same uid and gid, don't really have to do anything with permissions after you chown everything to said uid/gid.