Security as Apache Module

I thought I was making progress towards understanding PHP's security model... but now I'm not so sure. I compiled PHP with --enable-safe-mode as an Apache module, and I've specified a single directory for serving php scripts that is outside the html document tree. I thought this meant that I was still exposed to scripts deleting files in the html document tree. But when I run the following php function: function testunlink($file) { unlink($file); } from a web page against a file in the html document tree... php steps in and says I have insufficient permissions to execute the command. Which is odd, because I set 'nobody' as the owner of the file I was trying to delete. Can someone enlighten me as to what is going on here? Not that I object to not being able to delete files... but I want to understand why I wasn't able to. - Mark - Mark mark@REMOVETHIS STUFF@arcabama.com