In your situation, you've the owner of the folder and its directories, say apache. Kevin is the user which is allowed to read the contents, but not write or execute it. All others are denied read, write and execute permissions.
This fits perfectly in the Linux filesystem permissions system.
permission bits
Read 4
Write 2
eXecute 1
Each file or directory can be given permissions based on the owner, group or everyone else.
- The owner (
apache) can do anything, so let's give it read and write permissions (4 + 2 = 6)
- To prepare for the future, in case you need to give someone other Kevin read permissions to the file, create a new group, say
apache-users. Then, add Kevin to this group and set the group permission bits to 4 (Read)
- Next, deny anyone who do not own the file or is not a member of the
apache-users group all permissions, 0.
To add the group apache-users and add Kevin as a member, go to System -> Users and Groups. Open the tab Local Groups and press Create a new group. Enter the group name (apache-users) at Group name. Select Kevin at Members and press ->. Confirm these changes by pressing Create.
For a file, you would run the next commands to change the owner, group and permissions:
sudo chown apache filename
sudo chgrp apache-users filename
sudo chmod 640 filename
Directories
The permissions for directories are almost the same, except for the execute bit (1). The execute bit configures whether an user is allowed to descend in the directory, i.e. access other files and directories inside a directory. The read bit controls whether you can list the contents of a directory (ls).
So if a folder /dir is owned by root:root (group root), and the permissions of /dir/file is set to 777, you cannot access (read, write or execute) /dir/file if the permissions of /dir is set to 666 or 770 (note the missing eXecute permission).
The permissions for a folder would become 750: read, write and execute (7) for the owner (apache), read and execute (5) for the group (apache-users) and no permissions (0) for anyone else.
For your setup, the permissions become (* = depends):
location owner group permissions
/ root root 755
/var/ root root 755
/var/www/ root root 755
/var/www/kevin/ kevin * 700 or 750
/var/www/apache/ apache apache-users 750
/var/www/other/ * * 700 or 750
/var/www/anyoneread/ * * 755
/var/www/other/ is the directory of some other user which do not allow you (kevin) to dive in the directory.
