I just set up a basic nginx server on my Debian 7.0 server. The config file /etc/nginx/nginx.conf is barely modified, and begings with:

user www-data; # nginx shall run as user `www-data`

I then set up a server configuration (file /etc/nginx/sites-available/filenamehere), which includes the following directives:

root /home/diti/www
access_log /home/diti/logs/access.log;

I executed setfacl so that nginx can read all data in /home/ directories, and created the file /home/diti/logs/access.log as a regular user (username is diti).

$ whoami

$ groups diti
diti : diti

$ ls -lh /home/diti/logs/access.log
total 12K
-rw-r-x---+ 1 www-data diti 8.9K Mar 13 16:47 access.log

$ tail /home/diti/logs/access.log
tail: cannot open `access.log' for reading: Permission denied

$ getfacl /home/diti/logs/access.log
getfacl: Removing leading '/' from absolute path names
# file: home/diti/logs/access.log
# owner: www-data
# group: diti

How comes I am not able to read the log file, owned by www-data:diti? I should be able to, since I (diti) belong to group diti, and group permissions for the log file are set to r-x.

Is it because of ACL? My filesystem is ext4.


getfacl shows you that the group does not have any permission.

The ls output -rw-r-x---+ is confusing. It does not mean that the group has these permissions but that "someone specific and different from the owner" has it.

  • Thank you for pointing that to me! I had a better reading at what ACL actually is, and I came up with the following command: setfacl -R -m user:www-data:r-x,d:user:www-data:r-x,g:diti:r-x /home/diti/logs, which grants nginx (www-data) to read files and directories in /home, and grants diti the right to read and execute everything in the log directory. I didn't know ACL did "replace" the UNIX permissions! – Diti Mar 13 '14 at 23:03
  • @Diti ACL doesn't "replace" the classic ugo permissions. Adding a user object does not change the old permissions at all. I guess the file did not have group permissions before you ran setfacl. – Hauke Laging Mar 13 '14 at 23:13
  • You are most likely right – I just noticed my umask is 077 (instead of the "usual" 022, granting read permissions to group). I'll try not to assume anything any more before asking questions on SE! ^^ – Diti Mar 14 '14 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.