User Can't Enter Directory Even Though Permissions are 777

Question

I created the user nils on my Raspberry Pi and want it to be able to access /media/christoph. I tried everything and tried to rage-quit by setting the permissions of that folder recursively to 777 but even that doesn't work.

christoph@christoph-pi:~$ su - nils
Password: 
nils@christoph-pi:~$ cd /media/
nils@christoph-pi:/media$ cd christoph/
-su: cd: christoph/: Permission denied
nils@christoph-pi:/media$ ll
total 12
drwxr-xr-x   3 root      root 4096 Mar 25 00:42 ./
drwxr-xr-x  22 root      root 4096 Jul 13 16:27 ../
drwsrwsrwt+  3 christoph git  4096 Aug  6 17:05 christoph/
nils@christoph-pi:/media$ id
uid=1001(nils) gid=1001(nils) groups=1001(nils),1003(git)
nils@christoph-pi:/media$ logout
christoph@christoph-pi:~$ cd /media/
christoph@christoph-pi:/media$ sudo ls -alZ
total 12
drwxr-xr-x   3 root      root ? 4096 Mar 25 00:42 .
drwxr-xr-x  22 root      root ? 4096 Jul 13 16:27 ..
drwsrwsrwt+  3 christoph git  ? 4096 Aug  6 17:05 christoph

How to I grant the user nils permission to enter that folder?

Answer 1

The + is a sign of ACL (Access Control List), to remove all permissions from the user nils and make it available to use the target directory or file, you need to use:

setfacl -x u:nils /media/christoph

OR you should give permissions by using the command below, for instance if you want it to have read and right permissions you can do:

setfacl -m u:nils:rw /media/christoph

Answer 2

The + at the end of the ls permissions means there is an ACL set on this file. The ACL overrides the standard permissions.

e.g.

$ mkdir X
$ chmod 777 X
$ ls -ld X
drwxrwxrwx 2 sweh sweh 4096 Aug  6 11:34 X/
$ setfacl -m 'u:vbox:---' X
$ ls -ld X                 
drwxrwxrwx+ 2 sweh sweh 4096 Aug  6 11:34 X/

So at this point we have a 777 directory with an ACL, indicated by the +

$ sudo su vbox
vbox:/tmp$ cd X
bash: cd: X: Permission denied
vbox:/tmp$ ls -ld X
drwxrwxrwx+ 2 sweh sweh 4096 Aug  6 11:34 X
vbox:/tmp$ getfacl X
# file: X
# owner: sweh
# group: sweh
user::rwx
user:vbox:---
group::rwx
mask::rwx
other::rwx

The vbox user can not go into this directory; getfacl shows the reason.