Permissions on Unix-like systems are managed in three distinct classes. These classes are known as user, group, and others.
Classes
Files and directories are owned by a user. The owner determines the file's owner class. Distinct permissions apply to the owner.
Files and directories are assigned a group, which define the file's group class. Distinct permissions apply to members of the file's group members. The owner need not be a member of the file's group.
Users who are not the owner, nor a member of the group, comprise a file's others class. Distinct permissions apply to others.
The effective permissions are determined based on the user's class. For example, the user who is the owner of the file will have the permissions given to the owner class regardless of the permissions assigned to the group class or others class.
Permissions
There are three specific permissions on Unix-like systems that apply to each class:
The read permission, which grants the
ability to read a file. When set for
a directory, this permission grants
the ability to read the names of
files in the directory (but not to
find out any further information
about them such as contents, file
type, size, ownership, permissions,
etc.)
The write permission, which grants
the ability to modify a file. When
set for a directory, this permission
grants the ability to modify entries
in the directory. This includes
creating files, deleting files, and
renaming files.
The execute permission, which grants
the ability to execute a file. This
permission must be set for executable
binaries (for example, a compiled c++
program) or shell scripts (for
example, a Perl program) in order to
allow the operating system to run
them. When set for a directory, this
permission grants the ability to
traverse its tree in order to access
files or subdirectories, but not see
files inside the directory (unless
read is set).
The effect of setting the permissions on a directory (rather than a file) is "one of the most frequently misunderstood file permission issues".
When a permission is not set, the rights it would grant are denied. Files created within a directory will not necessarily have the same permissions as that directory. The permissions to be assigned are determined using umasks.
Octal Notation
Octal notation consists of a three- or four-digit base-8 value.
With three-digit octal notation, each numeral represents a different component of the permission set: user class, group class, and "others" class respectively.
Each of these digits is the sum of its component bits (see also Binary numeral system). As a result, specific bits add to the sum as it is represented by a numeral:
The read bit adds 4 to its total (in
binary 100),
The write bit adds 2 to its total (in
binary 010), and
The execute bit adds 1 to its total
(in binary 001).
These values never produce ambiguous combinations; each sum represents a specific set of permissions.
Here is a summary of the meanings for individual octal digit values:
0 --- no permission
1 --x execute
2 -w- write
3 -wx write and execute
4 r-- read
5 r-x read and execute
6 rw- read and write
7 rwx read, write and execute
Also note that your file might be owned by user foo
, Apache typically runs as a different user (let's call it bar
). This means that if you want Apache to read it, you need to give group
or other
(depending of your setup) permission to read your file.
You can find more information about POSIX Filesystem permissions on Wikipedia.