The permissions to deny the user. The value is the same as with allow except that the given rights are revoked instead of granted. Thus, specifying "r--" would revoke read rights while leaving the write and execute rights untouched.