title: PHP File Permissions inside Apache
body: <p>I am creating a plugin-based PHP Application. For this application I have a config file which shall be readable only via the ConfigService.php.</p>
  
  <p>The problem is that currently it would be possible for every plugin, to read the whole config file with database host, user, ...</p>
  
  <p>Is there any possibility to restrict the file access via apache that only the service can read the config file?</p>
  
  <p>SourcePath:</p>
  
  <ul>
  <li>config
  
  <ul>
  <li>app.config</li>
  </ul></li>
  <li>plugins
  
  <ul>
  <li>PluginA</li>
  <li>PluginB</li>
  </ul></li>
  <li>web
  
  <ul>
  <li>Service
  
  <ul>
  <li>ConfigService.php</li>
  </ul></li>
  <li>src
  
  <ul>
  <li>[sources]</li>
  </ul></li>
  </ul></li>
  </ul>
  
  <p>My idea was something like defining open_basedir for the different directories.</p>
  
  <ul>
  <li>plugins may access plugins &amp; web/Service</li>
  <li>Service may access Service &amp; config</li>
  <li>Apache 
  
   with php_admin_value open_basedir "...plugins;...web/Service"
  </li>
  </ul>
  
  <p>Or something like:</p>
  
  <pre><code>&lt;Files ...config/app.config&gt;
     Order Deny,Allow
     Allow From ...Service/ConfigService.php
  &lt;/Files&gt;
  </code></pre>
  
  <p>Does anyone has some ideas how to solve this?
  Thanks :)</p>