File Permissions

File permissions in PHP (and Unix/Linux systems generally) determine who can read, write, or execute files and directories. PHP scripts often need to manage permissions when handling uploaded files, creating log directories, or setting up deployment configurations.

Why file permissions matter for PHP:

• Security: Overly permissive files (777) allow any process or user on the server to read, modify, or execute them — a major security risk, especially for configuration files containing credentials.
• Functionality: PHP cannot write to an upload directory without write permission. Files set without execute permission cannot be run.
• Least privilege principle: Each file and directory should have the minimum permissions required for its purpose.

Typical permission settings:

• PHP source files: 644 (owner read/write, group read, others read)
• Upload directories: 755 (owner read/write/execute, others read/execute)
• Configuration files with credentials: 640 or 600 (readable only by owner/group)
• CLI scripts that need to be executed: 755

PHP functions for working with permissions:

• chmod() — change permissions
• fileperms() — read current permissions
• chown() — change owner (requires elevated privileges)
• is_readable(), is_writable(), is_executable() — check permission status

PHP process context: PHP scripts run as the web server user (e.g., www-data on Debian/Ubuntu). Files created by PHP are owned by that user. Ensure the web server user has appropriate access to upload directories but not to sensitive configuration files.

Use fileperms() to retrieve the numeric permissions of a file, then format the result for readability:

$filename = '/var/www/app/upload/avatar.jpg';

// Get permissions as an integer
$perms = fileperms($filename);

// Format as octal string (e.g., "0644")
$octal = substr(sprintf('%o', $perms), -4);
echo $octal; // "0644"

// Check specific permission bits
$isReadable   = is_readable($filename);
$isWritable   = is_writable($filename);
$isExecutable = is_executable($filename);

echo "Readable: " . ($isReadable ? 'Yes' : 'No') . "\n";
echo "Writable: " . ($isWritable ? 'Yes' : 'No') . "\n";

Formatted octal display (like ls -l):

$info = '';
$info .= (($perms & 0x0100) ? 'r' : '-'); // owner read
$info .= (($perms & 0x0080) ? 'w' : '-'); // owner write
$info .= (($perms & 0x0040) ? 'x' : '-'); // owner execute
$info .= (($perms & 0x0020) ? 'r' : '-'); // group read
$info .= (($perms & 0x0010) ? 'w' : '-'); // group write
$info .= (($perms & 0x0008) ? 'x' : '-'); // group execute
$info .= (($perms & 0x0004) ? 'r' : '-'); // others read
$info .= (($perms & 0x0002) ? 'w' : '-'); // others write
$info .= (($perms & 0x0001) ? 'x' : '-'); // others execute
echo $info; // e.g., "rw-r--r--"

Note: fileperms() results are cached by PHP's stat cache. If you change permissions and check again in the same script, call clearstatcache() first.

On Unix/Linux systems (where PHP is most commonly deployed), permissions are assigned separately for three groups:

• Owner — the user who owns the file
• Group — a Unix group associated with the file
• Others — everyone else

For each group, three permission bits apply:

Read (r / 4)

• File: Can view the file's contents
• Directory: Can list the directory's contents (ls)

Write (w / 2)

• File: Can modify the file's contents, truncate it, or delete it
• Directory: Can create, rename, or delete files within the directory

Execute (x / 1)

• File: Can run the file as a program (a PHP script, shell script, binary)
• Directory: Can cd into the directory and access its contents

Octal notation: Permissions are expressed as a 3-digit octal number (or 4-digit including the setuid/setgid/sticky bit):

• 7 = rwx (4+2+1)
• 6 = rw- (4+2)
• 5 = r-x (4+1)
• 4 = r-- (4)
• 0 = --- (no permissions)

Common permission patterns:

• 644 — owner read/write, group and others read-only (typical for web files)
• 755 — owner full access, group and others read/execute (typical for directories and scripts)
• 600 — owner read/write only (config files with secrets)
• 777 — everyone full access (avoid — security risk)

In PHP, chmod('/path/to/file', 0644) sets these permissions (note the leading 0 for octal notation in PHP).

In PHP, chmod() is used to set file or directory permissions. It takes a file path and a permissions value in octal notation.

chmod('/var/www/app/storage', 0755);   // directory: owner rwx, group rx, others rx
chmod('/var/www/app/config/db.php', 0640); // config file: owner rw, group r, others none
chmod('/var/www/app/uploads/file.txt', 0644); // file: owner rw, group r, others r

Octal permission breakdown: Each digit represents permissions for owner, group, and others respectively:

• 4 = read, 2 = write, 1 = execute
• 7 = 4+2+1 = read+write+execute
• 6 = 4+2 = read+write
• 5 = 4+1 = read+execute
• 4 = read only

// Must use octal literal (leading 0) — NOT a string
chmod($file, 0644); // correct
chmod($file, '644'); // WRONG — treated as decimal 644, not octal
chmod($file, 644);   // WRONG — decimal 644 ≠ octal 0644

Return value: true on success, false on failure (check permissions of the running PHP process).

Verify the change:

chmod($file, 0644);
clearstatcache(); // clear PHP's stat cache before checking
echo substr(sprintf('%o', fileperms($file)), -4); // "0644"

PHP process limitation: chmod() only works if the PHP process (running as the web server user, e.g., www-data) owns the file or has sufficient privilege. On shared hosting, this is often restricted.

chmod() (change mode) is a PHP function that changes the permission mode of a file or directory. It mirrors the Unix chmod command.

Syntax:

chmod(string $filename, int $permissions): bool

Usage:

// Set a directory to be writable by the web server
chmod('/var/www/app/storage/logs', 0775);

// Protect a credentials file — only owner can read/write
chmod('/var/www/app/.env', 0600);

// Make a shell script executable
chmod('/var/scripts/deploy.sh', 0755);

Critical syntax rule — use octal literals:

chmod($file, 0644); // correct: octal literal (leading zero)
chmod($file, 644);  // WRONG: decimal 644 = octal 1204 — sets wrong permissions
chmod($file, '0644'); // WRONG: string, not integer

Return value:

• true — permissions changed successfully
• false — failed (likely because the PHP process doesn't own the file)

Checking after change:

chmod($file, 0644);
clearstatcache();  // clear PHP's cached stat info
echo decoct(fileperms($file) & 0777); // outputs "644"

Common use cases in PHP:

• After moving an uploaded file, set appropriate permissions
• During deployment scripts, ensure log and cache directories are writable
• During installation wizards, check and fix directory permissions

Security reminder: Never set files to 0777 on a production server. Prefer the minimum permissions required.