I have a web app in the folder:


In there I have an executable file and the folder assets.

Nginx is setup this way - to serve assets only:

  location ~ ^/assets/(images|css|js| [.........])/(.*) {
    alias /home/main_user/dir1/dir2/my_web_app/assets/$1/$2;
    autoindex off;

Nginx is running under user "http"

It turns out that nginx has permission denied error for the "assets" folder. Even when I changed the owner of directory "assets" to be "http" and gave it 755

To fix the error I'll have to give permissions "o+x" all the way from the root up to the folder "assets". Not merely to the folder "assets"

Namely, I'll have to call "o+x" for:



This seems wrong to me, at least because everyone would be permitted to execute any file in /home/main_user. But doing that only for the directory "assets" doesn't work.

Is there a better and, more over, recommended way?

  • @Fox post your answer
    – nylypej
    Commented Dec 31, 2018 at 3:53

1 Answer 1


On a directory's permissions, the execute bit actually means "allow access to files and directories contained within this one" (while the read bit allows one to list the contents of the directory). So you are correct that the http user will need at least x permission along the entire chain of directories.

That said, you don't have to grant this access to all users. With ACLs, you can allow access just for the http user. See setfacl(1) for full details, but setfacl -m u:http:x /home (and the other intervening directories) should get you started.

An alternative way to grant access to a single user is to set the owning group of the files to one that contains all and only those users that should be able to access them and set group permissions accordingly. One issue with this approach is that, in general, it can result in the creation of a huge number of groups. Another is that this approach is incompatible with, say, a file writable by two people, readable by some group, and inaccessible by others. That is why we use ACLs.

  • what do you mean by "should get you started"?
    – nylypej
    Commented Dec 31, 2018 at 10:53
  • It will be sufficient to avoid permission errors, but there are more advanced options (like default ACLs) that might make things more convenient later
    – Fox
    Commented Dec 31, 2018 at 19:57
  • Ok. Isn't there a way to archive the same thing via the standard commands such as chown, chmod.... ?
    – nylypej
    Commented Dec 31, 2018 at 20:48
  • actrually, setfacl -m u:http:x /home alone doesn't work -- error 403 still
    – nylypej
    Commented Dec 31, 2018 at 20:57
  • The "etc" was "and the rest of the directory chain". Sorry for not being clear about that. ACLs are "standard" as in "available everywhere" (though on macOS the functionality is part of chmod)
    – Fox
    Commented Dec 31, 2018 at 21:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .