wordpress minimum permissions required to install plugins directly

Hi,

I’m wondering what the absolute minimum permissions are to allow wordpress to install/delete/update plugins and themes directly.

Reading Hardening_WordPress it would appear that the only directory that should be writable by the webserver (apache in my case) should be wp-content, which makes sense to me…

However I only appear to be able to install/dete a plugin if the apache user also has write access to wp-admin (which seems like a bit of a security risk…)

What is wordpress trying to write to in the wp-admin directory when installing plugins directly (not via ftp/ssh etc)?
And Why?

Or should this actually work without the apache user having write access to the wp-admin directory??

Thanks!

Paul