---
title: "CGI and FastCGI permissions"
date: "2014-12-04"
category: "cgi-passenger"
slug: "cgi-fastcgi-permissions"
---

## Overview

CGI and FastCGI scripts run as the file owner and must meet strict permission requirements to prevent malicious behavior. Any script ending in `.cgi` on your hosting account must satisfy the following rules.

## Permission Requirements

1. **File permissions must be 755** (`u=rwx,g=rx,o=rx`)
    - _Group_ and _Other_ cannot have write permissions, preventing code injection into your script
    - _Other_ (web server) must be able to read the file before handing it off to suEXEC
2. **Directory permissions must be 755** (`u=rwx,g=rx,o=rx`)
    - _Group_ and _Other_ cannot create files in the directory that could be executed as CGI scripts
    - _Other_ (web server) must be able to open the directory to serve the request
3. **File owner must match directory owner**
    - Prevents other users from injecting scripts into the same directory
4. **File must be executable from the shell**
    - suEXEC launches scripts via the [execve](http://linux.die.net/man/2/execve) system call

Permissions can be set via FTP or **Files** > **File Manager** within the [[logging-into-the-control-panel]]. See [[permissions-overview]] for details.

## Shebang Requirements

Every CGI script must begin with a shebang line in the form `#!/usr/bin/exec args`. Common examples:

- Python: `#!/usr/bin/env python`
- PHP: `#!/usr/bin/php -q`
- Perl: `#!/usr/bin/perl`
- Bash: `#!/bin/sh`

The shebang (`#!`) must appear on the very first line, followed by a Unix-style newline (`\n`). Scripts using Mac (`\r`) or Windows (`\r\n`) line endings will fail. You can convert line endings using [[changing-eol-markers]] within the control panel.

## See Also

- [[permissions-overview]]
