Setting 0777 on a
folder (and I'm talking about a folder here, not a file) doesn't involve any execution security risk like some would state.
Execute is needed on a directory to access the inode information of the files within. You need this to search a directory to read the inodes of the files within. For this reason the execute permission on a directory is often called search permission instead.
The risks are:
- anybody can read files in this folder (provided the file itself has the
r permission on the user/group trying to read it, or for
- anybody can create files in this folder (and optionally execute them, but only the ones created by this specific user)
- anybody can delete files owned by other people in this folder (your files are not secured, whatever owner/permission they have)
If you want to secure some files, you have to create another folder with "normal" permissions (rw for you only, or rw for you and your group) and put your files in it.
On the other hand, nobody could turn a non-executable file into an executable one (chmod are not permitted if you don't own the file).
What the risks are not?
Some people think 0777 is inherited by every file in the folder. This is wrong. You can't edit a file if you don't have the
w permission just because its parent folder is 0777. You can't read a file if it doesn't have the
How to secure it?
If you have access to some shell or if your FTP client allows you to change the owner of the files and you know which owner you need, then you could create the folder and set its owner to the apache process (usually,
apache) and just set 0700 permissions. Problem is, other users, like you when browsing using your FTP client, won't be able to read the files created later by PHP, which is not necessarily an issue.
OK but what about files?
I'm not talking about risks inherent to
files execution because there's no reason you would want to force the
x permission on a file that shouldn't be executed in the first place.
If some web app needs to write in an existing file, setting it to 0666 (or 0600 if the owner is the apache user) is enough.