title: How do file permissions work on OpenShift?
body: <p>I think I'm misunderstanding something fundamental about file permissions in an OpenShift PHP app.  How do they actually work?</p>
  
  <p>I develop on OSX and push changes using SourceTree.  When I log in to the app via an SFTP program (Cyberduck) the index.php file shows its permissions set to 600, yet visitors can view it OK in a browser.</p>
  
  <p>This surprises me, as I thought the file would require permissions of 644 to be browsable (like an Apache webserver).</p>
  
  <p>On OpenShift, it seems as though file permissions 600, 640 and 644 are all equivalent.  Is this correct, or am I doing something wrong?</p>
  
  <p>Related:
  My OpenShift app has a cgi-bin folder containing a cgi program that should only be executed (called) from a PHP file.  In other words, any PHP script should be able to call this cgi program, but a visitor attempting to browse to the cgi-bin folder directly should not.</p>
  
  <p>I set both the cgi-bin folder and cgi program file permissions to 700 (so only the 'owner' has read/write/execute set, and no permissions are granted for 'group' and 'others').  However visitors can still browse to the program URL directly and execute it (e.g. www.example.com/cgi-bin/program.cgi) - as if the permissions were 777.  How do I solve this?</p>