diff --git a/core/modules/system/lib/Drupal/system/Tests/System/SitesDirectoryHardeningTest.php b/core/modules/system/lib/Drupal/system/Tests/System/SitesDirectoryHardeningTest.php
new file mode 100644
index 0000000..4c8c5e4
--- /dev/null
+++ b/core/modules/system/lib/Drupal/system/Tests/System/SitesDirectoryHardeningTest.php
@@ -0,0 +1,85 @@
+<?php
+
+/**
+ * @file
+ * Definition of Drupal\system\Tests\System\SitesDirectoryHardeningTest.
+ */
+
+namespace Drupal\system\Tests\System;
+
+use Drupal\simpletest\WebTestBase;
+
+/**
+ * Test unicode handling features implemented in unicode.inc.
+ */
+class SitesDirectoryHardeningTest extends WebTestBase {
+
+  public static function getInfo() {
+    return array(
+      'name' => 'Sites directory hardening',
+      'description' => 'Tests Drupal permissions hardening of /sites subdirectories.',
+      'group' => 'System',
+    );
+  }
+
+  /**
+   * Test that the default behavior to restrict permissions on the current
+   * sites directory and on settings.php is enforced.
+   */
+  function testSitesDirectoryHardening() {
+    $conf_path = conf_path();
+    $settings = $conf_path . '/settings.php';
+
+    // First, we check based on what the initial install has set.
+    $this->assertTrue(drupal_verify_install_file($conf_path, FILE_NOT_WRITABLE, 'dir'), t('Verified permissions for !file.', array('!file' => $conf_path)));
+
+    // We intentionally don't check for settings.local.php as that file is
+    // not created by Drupal.
+    $this->assertTrue(drupal_verify_install_file($settings, FILE_EXIST|FILE_READABLE|FILE_NOT_WRITABLE), t('Verified permissions for !file.', array('!file' => $settings)));
+
+    // Intentionally make our sites directory and settings.php writable.
+    chmod($conf_path, 0744);
+    chmod($settings, 0744);
+
+    // Manually trigger the requirements check.
+    module_load_install('system');
+    system_requirements('runtime');
+
+    $this->assertTrue(drupal_verify_install_file($conf_path, FILE_NOT_WRITABLE, 'dir'), t('Verified permissions for !file after manual permissions change.', array('!file' => $conf_path)));
+    $this->assertTrue(drupal_verify_install_file($settings, FILE_EXIST|FILE_READABLE|FILE_NOT_WRITABLE), t('Verified permissions for !file after manual permissions change.', array('!file' => $settings)));
+  }
+
+  /**
+   * Test that when when directory hardening is disabled that a writable file
+   * remains writable.
+   */
+  function testSitesDirectoryHardeningConfig() {
+    $conf_path = conf_path();
+    $settings = $conf_path . '/settings.php';
+
+    // Disable permissions enforcement.
+    config('system.site')->set('sites_permissions', TRUE)->save();
+
+    // Intentionally make our sites directory and settings.php writable.
+    chmod($conf_path, 0744);
+    chmod($settings, 0744);
+
+    // Manually trigger the requirements check.
+    module_load_install('system');
+    system_requirements('runtime');
+
+    $this->assertTrue(is_writable($conf_path), t('Site directory remains writable when automatically fixing permissions is disabled.'));
+    $this->assertTrue(is_writable($settings), t('settings.php remains writable when automatically fixing permissions is disabled.'));
+
+    // Re-enable permissions enforcement.
+    config('system.site')->set('sites_permissions', FALSE)->save();
+
+    // Manually trigger the requirements check.
+    module_load_install('system');
+    system_requirements('runtime');
+
+    $this->assertFalse(is_writable($conf_path), t('Site directory is protected when automatically fixing permissions is enabled.'));
+    $this->assertFalse(is_writable($settings), t('settings.php is protected when automatically fixing permissions is enabled.'));
+  }
+}
+
diff --git a/core/modules/system/system.install b/core/modules/system/system.install
index 9d823ca..fdc44bb 100644
--- a/core/modules/system/system.install
+++ b/core/modules/system/system.install
@@ -231,12 +231,22 @@ function system_requirements($phase) {
   if ($phase == 'runtime') {
     $conf_errors = array();
     $conf_path = conf_path();
-    if (!drupal_verify_install_file($conf_path, FILE_NOT_WRITABLE, 'dir')) {
+
+    // Allow system administrators to ignore permissions hardening for the site
+    // directory. This allows additional files in the site directory to be
+    // updated when they are managed in a version control system.
+    if (config('system.site')->get('sites_permissions')) {
+      $message = $t('Protection disabled');
+      $severity = REQUIREMENT_WARNING;
+    }
+    elseif (!drupal_verify_install_file($conf_path, FILE_NOT_WRITABLE, 'dir')) {
+      $message = $t('Not protected');
+      $severity = REQUIREMENT_ERROR;
       $conf_errors[] = $t("The directory %file is not protected from modifications and poses a security risk. You must change the directory's permissions to be non-writable.", array('%file' => $conf_path));
     }
     foreach (array('settings.php', 'settings.local.php') as $conf_file) {
       $full_path = $conf_path . '/' . $conf_file;
-      if (file_exists($full_path) && !drupal_verify_install_file($full_path, FILE_EXIST|FILE_READABLE|FILE_NOT_WRITABLE)) {
+      if (file_exists($full_path) && (config('system.site')->get('sites_permissions') || !drupal_verify_install_file($full_path, FILE_EXIST|FILE_READABLE|FILE_NOT_WRITABLE))) {
         $conf_errors[] = $t("The file %file is not protected from modifications and poses a security risk. You must change the file's permissions to be non-writable.", array('%file' => $full_path));
       }
     }
diff --git a/sites/default/default.settings.php b/sites/default/default.settings.php
index 20f4490..81272f8 100644
--- a/sites/default/default.settings.php
+++ b/sites/default/default.settings.php
@@ -559,6 +559,20 @@
 # $conf['allow_authorize_operations'] = FALSE;
 
 /**
+ * Override file system permissions hardening.
+ *
+ * The system module will periodically check the permissions of your site
+ * site directory to ensure that they are not writable by the website user.
+ * For sites that are managed with a version control system, this can cause
+ * problems when files in that directory (such as a "settings.inc" containing
+ * additional configuration) when the files are updated, as the user pulling
+ * in the changes won't have permissions to modify files in the directory.
+ *
+ * Remove the leading hash sign to disable permissions hardening.
+*/
+# $conf['ignore_site_directory_permissions'] = TRUE;
+
+/**
  * Load local development override configuration, if available.
  *
  * Use settings.local.php to override variables on secondary (staging,