Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I encounter a strange problem on a unix/linux machine:

I'm member of a group, let's call it group A and a certain file (which has a different owner) belongs to group A as well. The permissions of that file are

-rw-rw----

so I'd expect I should be able to open that file, but I am not: I'll get the "Permission denied" error message when I try to look at the file's content (using cat).

Since the permissions seem to be correct, what else could be causing this? Are there "overriding" permission restrictions in place? If so, how would I find out?

share|improve this question
1  
What about directory permissions? –  Karlson Oct 13 '12 at 18:04
    
If you are in multiple groups, is your current group set to A? –  Code-Guru Oct 13 '12 at 19:49
2  
@Karlson, if directory permissions were the issue, you wouldn't be able to see the file's permissions in the first place. –  cjm Oct 13 '12 at 22:02
    
Show us the full path and filename please. –  jippie Oct 14 '12 at 9:13
    
It's in /home/theotheruser/somefolder/bla.txt I am in multiple groups. –  Lagerbaer Oct 14 '12 at 18:31

3 Answers 3

With NFS, it depends which security mode you use, but in the traditional one, the list of groups the user belongs to is sent by the client to the server, and there's a limit on the number of groups that can be sent (it was 16 the last time I checked).

So, the client says: I'm uid 1234 and by the way I'm member of groups 12, 13, 14... If you're in more than 16 groups, that list will be truncated and there will be groups for which the server is not aware you're a member of it.

That's probably the explanation for it. Only the system administrator of the local and/or remote machine can do something about that either by changing the security model or the setting of the NFS server or by reducing the number of groups you're a member of.

share|improve this answer
    
I have a strong feeling that this is the reason, because the group I'm appears at position 19 in the output of the "groups" command. I'll show this answer to the sys admin and see if it helps. :) –  Lagerbaer Oct 15 '12 at 16:21

Have you logged out and logged back in again since you were added to group A ?

If not, your current login processes will only have the group memberships that it had at the time of login, not any changes since. And any child processes of that login will have the same group memberships (i.e. if you logged into X then every application including your terminal emulator and shell)

You can test this by logging in again on another console or via ssh, or something like exec sudo -u $(id -u -n) -i (to effectively kill and replace the current shell with a new shell - any background processes belonging to that shell will be orphaned)

share|improve this answer
    
No, that wasn't the problem; I logged out and back in and that didn't resolve it. –  Lagerbaer Oct 14 '12 at 18:37

Could be ACLs. See

getfacl the-file

Could be that for some reason, the groups you're meant to be in is not properly set. Check with

id -a

What about

namei -xl "$(readlink -f the-file)"

getfattr -dm- the-file

sudo lsattr the-file

What's the type of the filesystem it resides in?

Any apparmor, SELinux or any other mandatory access control in place in the system?

You're sure the file doesn't contain the text "Permission denied", right ;-) ?

share|improve this answer
    
Nope, there's no special ACL, it just repeats what the standard flags tell me, and id -a tells me that I am in that file's group –  Lagerbaer Oct 13 '12 at 17:56
    
The weird thing is, I can see the files of another user belonging to group B, of which I'm also a member... –  Lagerbaer Oct 14 '12 at 18:38
    
File system appears to be nfs4. namei gives me / and home belonging to root, root. /home/username belonging to username and group X (of which I am not a member), then the rest is /home/username/path1/path2/file where path1 belongs to username and group X, and path2 belongs to username, and group A, of which I'm a member. –  Lagerbaer Oct 15 '12 at 1:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.