<help>I would really appreciate those of you who understand all of this to please check the below is in order since it is a sticky , I am not a unix user , not a trained administrator so any pointers errata are welcomed !!!</help>
OK so many questions regarding this subject so...here we go.
Files on any *NIX system have a, at first glance ,complex ownership/permission system , its actually not that complex but can be intimidating at first.
Now you may think you don't need to understand them (and for most web-related work you probably don't ), however knowledge is power & once you do understand them , you will never again worry about the dreaded `permission denied` , dont skip though , read from the beginning , it makes more sense if you do.
The 3 common (there are more) *NIX permissions 'r' , 'w' , 'x' ( often 'e' or 'o' ) are applicable to 3 entities , the files 'owner' the files 'group' and 'others' (AKA 'everyone else' 'the world' )
Ownage
All files have an owner , who that owner is depends on who created them , when you upload a file via FTP the file is
owned by the user that you logged in as.
So if your FTP login is '
joe' then the file is most likely owned by user '
joe'.
When however you
create a file via script (fopen() etc) the file is still owned by whoever created it , however that user is no longer 'joe' , its the user that your webserver runs as , which is normally NOT your *UNIX username (except in chrooted or suexec environments) , it is normally 'apache' or 'nobody' .
[b]Groups[b/]
Groups are a bit of a sticky subject because how groups are assigned varies from system to system , often at the whim of the server administrator or hosting control panel interface , plesk for example assigns all file uploaded via FTP to the 'psacln' group , redhat however by default creates a new group for each user and assigns group ownership to that group (e.g. user 'joe' gets his own group 'joe').
Others AKA everyone else , the world
As far as *NIX is concerned , if someone is not the owner of the file or does not belong to the same group as a file , then you are classed as 'others' , contrary to popular belief external applications can not modify files which allow write access to 'others' , only other users of the same system or local network can actually do that (on shared hosting this is a real issue)
Permissions
All *NIX files have permissions assigned , there are 3 permissions a file can be given , 'r' for read , 'w' for write & 'x' for executable , a file can have 0 or more permissions . e.g. a file can have both 'r' and 'w' permissions , so they are both readable and writable , 'rwx' means you can do pretty much anything with the file.
Now the permissions above r,w & x are applied individually to the files owner , the files group and others ! so
owner group others user group
myfile rwx r r joe joe
With the above, the owner of the file (joe) can read write & execute (if applicable , e.g. the file is a script) the file , any members of the 'joe' group (usually just the user joe) can read and write to the file , 'others' can only read the file. when your webserver requests myfile , it does so as 'apache' or nobody' and as such is given read access.
However , when your script which is probably running as 'apache' comes along and tries to write to the file , it finds it can not .. why? , well 'apache' is not the owner of the file , nor does it belong to the group 'joe' , therefore as far as this file is concerned it belongs to the 'world' group which is only allowed to read, not write to the file.
to allow apache to write to the file you would need to change the file permissions to ...
owner group others user group
myfile rwx rw rw joe joe
e.g. give 'others' write 'w' access , so an outsider , such as apache , could write to the file.
vice-versa
Now lets say you created a file via a PHP script , the file created by PHP (actually by apache with mod_php) will be owned by 'apache' , if you then chmod the file (again via script) to say 0700 (rwx------) then you would not have permission to delete that file via FTP , since you would then be considered as 'others' !
Luckily if you created a file by script you can chmod it to something more accessible via script <?php chmod( 'myfile' , 0766 );?> , this will then allow you to read and write to the file via FTP.
so with the following
owner group others user group
myfile rwx r r joe joe
You can not chmod the script via PHP/apache since it only has read access , however if via FTP you (as 'joe') chmod to 0766 or 0777 , then your PHP script can read and write to the file.
Directories
Its often assumed that if a directory is not writable then nor are is contents , that however is <B>not</B> the case , a writable file in a read-only directory can still be altered by anyone with the right credentials , however you will not be able to write to that directory unless the directory is writable to the user or application that attempts the write.
Also to be able to list the directories contents , the directory must be executable to the application attempting to do so , 'read' is not enough (in fact you don't even need the directory to be readable , 'x' is enough.
scripts
Need to be executable , HTML & text files etc can simply be read-only , but if a file is a script , then make it executable !
.................................................................................................... .............................
modes
file permissions can be represented as octal modes , but that's easier than it sounds , if ...
r (read) = 4
w (write) = 2
x (execute) = 1
if the
owner of a file has read & write permissions that's
4+2 = 6
if the group just has read permission that's
4
if others also only have read permissions , again that's
4
so myfile below has the mode
0644
owner group others user group
myfile rw r r joe joe
.................................................................................................... .............................
chmod
As noted above chmod() can change the permissions of a given file , for a user or an application to change these permissions however the user or application needs to have write access to the file in the first place !!
for PHP its important when chmod()'ding to use octal values
chmod( 'myfile' ,
'0644
' ) ; will cause issues , since we are passing the mode as a string
chmod( 'myfile' , 644 ) ; here 644 , is , as far as PHP is concerned, decimal ! again be prepared for problems
chmod( 'myfile' , 0644 ) ; is correct !
.................................................................................................... .............................
chown & ghgrp
PHP has the chown & chgrp commands, however only a superuser can use them , so unless your webserver runs as 'root' or similar , you can't use them.
.................................................................................................... .............................
CGI disclaimer
If your server runs PHP as a CGI then much of the above may change , its is not common for CGI scripts to be run as a different user than the webserver via Apaches mod_suexec or phpsuexec etc
.................................................................................................... .............................
chrooted environments
If you webserver runs in a chrooted environment then its possible (probable) that the webserver (above stated as 'apache' or 'nobody') may well run as another user , often as the user account e.g the same as your FTP login , if this is the case then you will have less issues with file ownership & generally be in a much safer playground.
umask
Not really important here , but you may wonder why when you create a file via FTP or script that it is given e.g. 0755 for FTP or 0644 for scripts , this is decided by the umask , the responsibility of the server administrator
.................................................................................................... .............................
.................................................................................................... .............................
So , if you read the above , and if it made any sense at all

, you will understand why you can't ,immediately alter your files uploaded by FTP via a PHP script, if you don't then read again , if I am making no sense then please post and say so & I will try and clarify , if anyone wants to add to this document , post & I will add/amend