I just set up a basic nginx server on my Debian 7.0 server. The config file /etc/nginx/nginx.conf is barely modified, and begings with:

user www-data; # nginx shall run as user `www-data`

I then set up a server configuration (file /etc/nginx/sites-available/filenamehere), which includes the following directives:

root /home/diti/www
access_log /home/diti/logs/access.log;

I executed setfacl so that nginx can read all data in /home/ directories, and created the file /home/diti/logs/access.log as a regular user (username is diti).

$ whoami

$ groups diti
diti : diti

$ ls -lh /home/diti/logs/access.log
total 12K
-rw-r-x---+ 1 www-data diti 8.9K Mar 13 16:47 access.log

$ tail /home/diti/logs/access.log
tail: cannot open `access.log' for reading: Permission denied

$ getfacl /home/diti/logs/access.log
getfacl: Removing leading '/' from absolute path names
# file: home/diti/logs/access.log
# owner: www-data
# group: diti

How comes I am not able to read the log file, owned by www-data:diti? I should be able to, since I (diti) belong to group diti, and group permissions for the log file are set to r-x.

Is it because of ACL? My filesystem is ext4.

1 Answer 1


getfacl shows you that the group does not have any permission.

The ls output -rw-r-x---+ is confusing. It does not mean that the group has these permissions but that "someone specific and different from the owner" has it.

  • Thank you for pointing that to me! I had a better reading at what ACL actually is, and I came up with the following command: setfacl -R -m user:www-data:r-x,d:user:www-data:r-x,g:diti:r-x /home/diti/logs, which grants nginx (www-data) to read files and directories in /home, and grants diti the right to read and execute everything in the log directory. I didn't know ACL did "replace" the UNIX permissions!
    – Diti
    Mar 13, 2014 at 23:03
  • @Diti ACL doesn't "replace" the classic ugo permissions. Adding a user object does not change the old permissions at all. I guess the file did not have group permissions before you ran setfacl. Mar 13, 2014 at 23:13
  • You are most likely right – I just noticed my umask is 077 (instead of the "usual" 022, granting read permissions to group). I'll try not to assume anything any more before asking questions on SE! ^^
    – Diti
    Mar 14, 2014 at 0:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .