How do I set the private file system path's permissions?
Your module has to implement hook_file_download(). By default all private files will give access denied. 

If your access rules are not complex, you can also use one of contrib modules, ex. Private files download permission