Linux File Permissions

Also Known As

TL;DR

Explanation

Each file has three permission sets: owner (u), group (g), others (o). Each set has read (r=4), write (w=2), execute (x=1). chmod 755 = owner rwx, group r-x, others r-x. Web server files: 644 for files (rw-r--r--), 755 for directories. PHP files should never be world-writable (666 or 777). Config files with secrets should be 600 (owner read/write only). The web server user (www-data) should be in the correct group — not given direct ownership of application files.

Common Misconception

Why It Matters

Common Mistakes

• Setting 777 to 'fix' permission errors instead of diagnosing the actual user/group mismatch.
• Making .env files world-readable — they contain secrets that any process on the server can read.
• Owning application files as root — the web server cannot write to them and deployment scripts fail.

Avoid When

• Never use 777 on any production file or directory — it is always a misconfiguration.
• Do not own application files as root — the web server user cannot write them and deployments will fail.

When To Use

• Set 644 for all PHP files and 755 for directories as the default — only loosen permissions when specifically required.
• Set 600 on .env and config files containing secrets — readable only by the file owner.

Code Examples

# chmod 777 — world-writable: any process on the server can modify files
chmod -R 777 /var/www/myapp  # critical misconfiguration

# Correct permissions for a PHP web app
find /var/www/myapp -type f -exec chmod 644 {} \;
find /var/www/myapp -type d -exec chmod 755 {} \;
# Writable directories (uploads, cache, logs) — owner only
chmod 700 /var/www/myapp/storage
# Secrets — owner read only
chmod 600 /var/www/myapp/.env

References

• ↗ https://www.php.net/manual/en/security.filesystem.php

Tags

Related Terms