Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is from file /etc/apache2/sites-enabled/000-default right after installing apache2 from repositories.

DocumentRoot /var/www
<Directory />
        Options FollowSymLinks
        AllowOverride None
<Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all

What does that first part set up? For me this looks that DocumentRoot should be / instead /var/www allowing that <Directory /> part to have any effect but I have to be wrong.

share|improve this question
up vote 4 down vote accepted

It sets up perms for the root ('/' is a dir in this context, it's not anything to do with closing the tag) and all the way down, unless overridden. Root down => your entire disk. Then it does override it for your DocRoot.

So in this file, it sets up very very restrictive perms (AllowOverride None) on the whole disk, then the next Directory stanza opens it up specifically for your DocRoot.

These restrictive perms on / also speeds things up. It allows FollowSymLinks, which means the webserver does NOT have to do an lstat() call on each directory all the way up to root, saving some disk syscalls. AllowOverrideNone also means you don't have to search for .htaccess files in those directories, cutting some more (slow) disk syscalls. Remember that for every request, the webserver has to consider every directory from the dir the content lives in all the way up to root. With these perms, you short circuit those checks, eliminating hits to disk, which are a real enemy.

share|improve this answer
So in <Directory /var/www/> Options FollowSymlinks and AllowOverride None are redudant? And the reason why those options are set in <Directory /> is becouse there are symlinks enabled and it is possible to "break out" from /var/www folder? – Joni Sep 29 '10 at 19:00
@joni. It depends how you look at it. Now you have 2 stanzas that are independent. you can change one, and know the other will still have the same perms as you thought. And yes, symlinks is one way you can 'break out', but there are others. Edited above some. – Rich Homolka Sep 29 '10 at 19:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.