The basic unix permissions come in three flavors;
Owner Permissions : These are permissions that you have on your own files or directories.
Group Permissions : These are permissions that you and anyone in your group have on the file files or directories.
Other Permissions : These are permissions that other people have on your files or directories if not you, or in your group
So, in Unix, when permissions are configured, the server allows you to define different permissions for each these three different categories of users. In a Web Serving environment these permissions are used to control which website owners can access which directories and files.
What do Unix permissions look like?
When viewing your files through an FTP client or from the servers command line;
filename.php username usergroup rwx r-x r-x
The first entry is the name of the file, the next entry is your username on the server, the second entry is the group that you are a member of and the last entry is the permissions assigned to that this file (or directory).
If you notice, I have intentionally spaced out the permissions section, I have grouped the 9 characters into 3 sets of 3. This separation is key to how the permissions system works.
The first set of 3 permissions (rwx) relate to the username seen above, the second set of 3 permissions (r-x) relate to the usergroup seen above and the final set of 3 permissions (r-x) relate to anyone else who is not associated with the username or groupname.
Owner (User) relates to username
The Owner (User) is normally you, these permissions will be enforced on your hosting account name.
Group relates to usergroup
The Group permissions will be enforced on other people that are in the same group as you, within a hosting environment, there is very rarely other people in the same group as you. This protects your files and directories from being made available to anybody else who may also have a hosting account on the same server as you.
Other relates to everyone else
The Other permissions, these will be enforced on anybody else on the server that is either not you or not in your group. So in a Web Serving environment, remembering that no-one else is normally in your group, then this is everybody else accessing the server except for you.
Each of the three sets of permissions are defined in the following manner;
r = Read permissions
w = Write permissions
x = Execute permissions
Owner Group Other
r w x r w x r w x
As many of you already know, permissions are normally expressed as a numeric value, something like 755 or 644. so, how does this relate to what we have discussed above?
Each character of the permissions are assigned a numeric value, this is assigned in each set of three, so we only need to use three values and reuse them for each set.
Owner Group Other
r w x r w x r w x
4 2 1 4 2 1 4 2 1
Now that we have a value that represents each permission, we can express them in numeric terms. The values are simply added together in the respective sets of 3, which will in turn give us just three numbers that will tell us what permissions are being set.
So, if we are told that a file has the permissions of 777, this would mean that the following was true.
Owner Group Other
r w x r w x r w x
4 2 1 4 2 1 4 2 1
Thus…
4+2+1 4+2+1 4+2+1
= 7 = 7 = 7
The Owner of the file would have full Read, Write and Execute permissions, the group would also have full Read, Write and Execute permissions, and the rest of the world can also Read, Write and Execute the file.
The standard, default permissions that get assigned to files and directories by the server are normally;
Files = 644 and Directories = 755
These permissions would allow, for files;
644 = rw- r– r– = Owner has Read and Write
Group has Read only
Other has Read only
and for directories;
755 = rwx r-x r-x = Owner has Read, Write and Execute
Group has Read and Execute only
Other has Read and Execute only
Now, things can get a little complicated when we start talking about shared Web Servers, the Web Server software will be running with its own username and groupname, most servers are configured for them to use either “apache” and “apache” or “nobody” and “nobody” as username and groupname.
So hear is the problem, your Web Server runs as its own user, and this user is not you or in your group, so the first two sets of permissions do not apply to it. Only the world (other) permissions apply.
Therefore, if you configure a permissions set similar to 640 on your website files, your Web Server will not be able to run your website files.
640 = rw- r– — = Owner has Read and Write
Group has Read only
Other has no rights
The WebServer is assigned no permissions at all and cannot Execute, Write or more importantly, even Read the file to delivery its content to a website visitors browser.
If a directory was to be assigned 750 permissions, this would have the same effect, because the WebServer does not even have permissions to read files in the directory, even if the files inside that directory had favorable permissions.
750 = rw- r-x — = Owner has Read and Write
Group has Read and Execute
Other has no rights
Directories have an extra quirk, if a directory does not have the Execute permission set in the World set then even if Read and Write are set, if the program is not run as the user or group, it will still not be able to access the files within the directory. The Execute setting allows the program to “Execute” commands in the directory, so without it being on the program(in our case a Web Server) cannot execute the “Read” command, thus cannot deliver your file to the users web browser.
