|
There are many explanations of Unix file permissions on the web and I have come away slightly confused. So, let me try a slightly different take. I assume here that we are taking the view of a webmaster on a shared account setup. Let's assume your account name is you and that your webserver runs under the account nobody. There may be other account names in the system set up by the web host either as individual accounts or globally. However, for simplicity, let's just work with the two accounts you and nobody. For purposes of understanding, we will change the notation and presentation order from what you see in other presentations. Any given file or directory, accounts can be in either of two roles: owner or other. There is also a group role, which can largely be ignored in a web hosting context because all accounts are normally treated as independent. If a file is created while you is logged in, you has the owner role and nobody has the other role. If the file is created by running a web page, nobody has the owner role and you has the other role. So, merely logging in to your site via FTP does not necessarily give you owner access to all of "your" files. It matters whether they were created via running one of your web pages or via your FTP login. To further muddy the situation, some web pages supplied by your web host (e.g. cPanel) will create the files under you because web host software can have special hooks into privileged programs that can change owners, hooks not available to any account holder. Before we can even think of working with a file, we need to consider the directory the file resides in or will reside in. Each directory has an owner, either you or nobody. The permission settings for the directory are 4 L directory may be listed 2 C files may be created or delete within the directory 1 A files may be accessed once created The permissions are a numeric sum of the numbers listed. It is typical for an owner to grant themselves full access (7) while restricting access for group and other. Thus, you may see a permission value of 755 which is read, in digits, left to right as the owner, group, and other role permisisions, respectively. A more expanded and easier to comprehend notation is LCAL-AL-A which is the same as 755. However, "LCA" notation is not what you conventionally see because the Unix "ls" command reports back the settings for files and marks the line with an initial "d". So, what ls reports back for a directory permission of 755 would look more like drwxr-xr-x Here, we will continue with LCA notation because our goal here is understanding. OK, now that we know about directory permissions, let's turn to file permissions. Again, we have 3 settings with numeric values: 4 R file may be read 2 W file may be written to (contents replaced) 1 X file may be executed The owner will not necessarily grant themselves full permission but will choose a value appropriate to the function of the file. An image or plain text file might have owner permisisions of 6 (RW-). A PHP file might have owner permissions of 6 (RW-) or 7 (RWX) with the required difference a complicated function of whether the PHP file is run from the command line (or by crontab) and how the web server is implemented. The point here is that owner permissions are not automatically defaulted to full permission. Likewise, other role permissions are usually a subset of owner permissions in most cases by turn off the write permission (2 W). From this exposition, it should be clear that a complete determination of permissions requires knowing your role for both the directory and file. For example: dir=other LCA file=owner RW- Note that your roles for the directory and file can differ, as illustrated. However, the illustration grants full LCA permission to other so the ownership is moot. The directory level permissions could prohibit access (1 A) for your role, making the RW settings somewhat moot. You may also have permission to write a file but not delete it. In all, there are 8 settings which apply to a file: 2 roles each for the directory and file, 3 permission settings for the directory, and 3 for the file. In many discussions, this gets reduced to just the 3 permission settings for the file itself. Such simplification is probably good enough for many of the situations you encounter. However, without understanding that there are actually 8 settings given your role, you will be banging your head trying to understand why you cannot accomplish something. |
Section Blog
