Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If in my server I have a file(for example a php file) with permission 777, can someone edit or delete it without having an account on the server?

share|improve this question
Either way, giving a file 777 permissions is bad practice. This especially goes for .php files on a webserver. – jippie Jun 1 '12 at 16:43

There are a couple ways I can think of that someone would be able to modify the file.

First, if they have physical access to the server, they can get the disk, mount it, and do anything they want to it.

Second, they can exploit some other accounnt on the server to do what they want - if that account has permissions to see that file (and 777 will give it if there are no ACLs or other security measures in place), then that person can modify the file. If it is a PHP file, the user that your web server runs as probably has permission to view the file, so if that is compromised, your file is exposed.

share|improve this answer
Or someone manages to exploit the webapp. The webapp (.php) will have all privileges on this file, including changing it/ – jippie Jun 1 '12 at 16:41

You can only modify a file if you can somehow write to the specific file. If you don't export the filesystem to a remote system there is no direct possibility to modify the file even with such relaxed permissions.

This doesn't mean you should use such relaxed permissions as the situation changes if you offer some kind of service on your machine, like webserver, ftp server etc. There is a possibility that some applications you are offering have some security problems like for example a website you are hosting on this server. This would allow someone without an account on your server to modify the file through the specific service, e.g. the change would occur as of the user the service is running, e.g. www-data

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.