I am trying to set permissions on my server properly. Currently I have a number of directories and files chmod'd at 0777 -- but I am not comfortable with it being this way.

So at the advice of a serverfault specialist, I had my hosting provider install ACL on my shared virtual server.

When I FTP to the server as my FTP user account "abc", I can do everything I need to do (and rightfully so) because all my dirs and files are owned by "abc", the group is "abc", and the 1st octet is set to 7 (rwx). That much I get.

But here's where it gets dark gray for me. PHP is set to user "nobody".

  • so when someone browses on of my web pages that either ends in .php or has some embedded PHP, I assume the last octet controls the access. Because all my dirs and files are owned by "abc" and assigned to group "abc", if the last octet was a 4 (r--) then the server would let the browser read the file. If it were a 6 (rw-) then the server would let the browser also write to the file or directory, correct?
  • what if the web document does not end in .php or does not have any PHP embedded? What is the user then?
  • how can I use ACL to not set the permission to 6 (rw-) or even 7 (rwx)? [not sure what execute does or means]

Just looking for some sort of policy settings to best lock down my dirs and files while allowing my PHP scripts to do uploads and write to files (so my users don't call me to tell me "permission denied".

Ok, thanks to anyone out there willing to lend me a hand. It is greatly appreciated.


Programs run with a certain user identity. PHP runs usually as a webserver module, and as such runs with the same user as the webserver, namely "nobody" in your case.

The browser runs on a remote system, and as such cannot write to your server. Only processes running on your server may write to it. When you access your server through a browser, the browser actually ask the webserver running on your server to go get some files. So the file rights apply the same, wether the file are php, html or whatever.

Execution bit may be important. It defines if a file can be executed as a new process (is a program or not). PHP files (or for the matter, any other kind of programs) run as CGI must be executable to run.

Execution bit is also necessary to be able to list a directory. This is somewhat weird, but that's why directories are executable.

Last, what about letting your php write to disk? Well, you'll have to write to some directory which is writable to "nobody". You can use ACLs to achieve that, instead of making nobody the owner of the directory. Simply give nobody the additional right to write to the folder you're interested in.

However be careful : it's very important that your writeable directory isn't under the web hierarchy. It would be a HUGE security hole : attackers could write executable files there, then make the webserver execute them which would lead to all sort of powerful attacks. Don't do that. So if your web root is /var/www , put your writable directory in /var/mywrite or elsewhere, but not under /var/www in any case.

  • @wazoox - thank you for commenting, a few things are starting to click. Re: execute, if my web document contains a lot of PHP (regardless of whether the doc ext is .php or .html) and all the PHP does is manipulate variables and gets parsed, then a 4 (r--) is good enough? What would be an example or 2 when I would need my PHP to be set to a 5 (r-x) or a 7 (rwx)? – H. Ferrence Feb 16 '11 at 23:26
  • @wazoox, and just the get the "under" part straight... I should not set a directory such as /var/www/mywrite to a 7 (rwx) but set /var/mywrite to a 7 (rwx)? Is web root and document root the same thing? – H. Ferrence Feb 16 '11 at 23:29
  • And if my understanding is correct here...I would have thought it would be the opposite -- the further the sub-dir is away from root the less of a security exposure it creates. – H. Ferrence Feb 16 '11 at 23:35
  • Ok, so my curiosity was piqued on this directory concept. So I looked at one of my long standing WordPress installs. Interesting to discover that ../wp-content/uploads is set to drwxrwxrwx (0777) with owner "abc" and group "123". And then sub-dirs within are set to drwxrwxrwx nobody nobody ... So does WordPress present a major security hole on the servers that it resides on? – H. Ferrence Feb 17 '11 at 12:54
  • 1° question : yes, 444 is good enough and it's safer because you're sure that nothing could modify your scripts. Being paranoid can't harm. – wazoox Feb 17 '11 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.