20

I encounter a strange problem on a unix/linux machine:

I'm member of a group, let's call it group A and a certain file (which has a different owner) belongs to group A as well. The permissions of that file are

-rw-rw----

so I'd expect I should be able to open that file, but I am not: I'll get the "Permission denied" error message when I try to look at the file's content (using cat).

Since the permissions seem to be correct, what else could be causing this? Are there "overriding" permission restrictions in place? If so, how would I find out?

12
  • 3
    What about directory permissions?
    – Karlson
    Oct 13, 2012 at 18:04
  • If you are in multiple groups, is your current group set to A?
    – Code-Guru
    Oct 13, 2012 at 19:49
  • 2
    @Karlson, if directory permissions were the issue, you wouldn't be able to see the file's permissions in the first place.
    – cjm
    Oct 13, 2012 at 22:02
  • 1
    Show us the full path and filename please.
    – jippie
    Oct 14, 2012 at 9:13
  • It's in /home/theotheruser/somefolder/bla.txt I am in multiple groups.
    – Lagerbaer
    Oct 14, 2012 at 18:31

5 Answers 5

14

Have you logged out and logged back in again since you were added to group A ?

If not, your current login processes will only have the group memberships that it had at the time of login, not any changes since. And any child processes of that login will have the same group memberships (i.e. if you logged into X then every application including your terminal emulator and shell)

You can test this by logging in again on another console or via ssh, or something like exec sudo -u $(id -u -n) -i (to effectively kill and replace the current shell with a new shell - any background processes belonging to that shell will be orphaned)

1
  • No, that wasn't the problem; I logged out and back in and that didn't resolve it.
    – Lagerbaer
    Oct 14, 2012 at 18:37
8

As you note in a comment, you don't have read permissions to /home/username. But to read /home/username/path1/path2/file, you need execute permissions for the whole path.

To debug this, run namei -l /home/username/path1/path2/file as the user who reads the file.

1
  • That was the problem in my case. I wanted to give another user rights to operate on the subfolder of my home dir, but my home dir has access 700, so they got "Permission denied" for any command.
    – Cerberus
    Oct 14, 2019 at 3:49
4

With NFS, it depends which security mode you use, but in the traditional one, the list of groups the user belongs to is sent by the client to the server, and there's a limit on the number of groups that can be sent (it was 16 the last time I checked).

So, the client says: I'm uid 1234 and by the way I'm member of groups 12, 13, 14... If you're in more than 16 groups, that list will be truncated and there will be groups for which the server is not aware you're a member of it.

That's probably the explanation for it. Only the system administrator of the local and/or remote machine can do something about that either by changing the security model or the setting of the NFS server or by reducing the number of groups you're a member of.

2
  • I have a strong feeling that this is the reason, because the group I'm appears at position 19 in the output of the "groups" command. I'll show this answer to the sys admin and see if it helps. :)
    – Lagerbaer
    Oct 15, 2012 at 16:21
  • How would you change the "security model" on NFS to solve this?
    – Danny
    Mar 28, 2017 at 5:26
3

Could be ACLs. See

getfacl the-file

Could be that for some reason, the groups you're meant to be in is not properly set. Check with

id -a

What about

namei -xl "$(readlink -f the-file)"

getfattr -dm- the-file

sudo lsattr the-file

What's the type of the filesystem it resides in?

Any apparmor, SELinux or any other mandatory access control in place in the system?

You're sure the file doesn't contain the text "Permission denied", right ;-) ?

3
  • Nope, there's no special ACL, it just repeats what the standard flags tell me, and id -a tells me that I am in that file's group
    – Lagerbaer
    Oct 13, 2012 at 17:56
  • The weird thing is, I can see the files of another user belonging to group B, of which I'm also a member...
    – Lagerbaer
    Oct 14, 2012 at 18:38
  • File system appears to be nfs4. namei gives me / and home belonging to root, root. /home/username belonging to username and group X (of which I am not a member), then the rest is /home/username/path1/path2/file where path1 belongs to username and group X, and path2 belongs to username, and group A, of which I'm a member.
    – Lagerbaer
    Oct 15, 2012 at 1:07
0

You need 'x' permission on each and every segment of the path

Every segment is like a room. To do something with the content of the room you must enter to explorer (X permission, it could be mnemonic if associated with word explore)

So to simply cat /a/b/c.txt you must have X on /, /a and /a/b directories

Then you are authorized to explorer b room and you must have (and you have in this your very case) the r on the file.

I know that question do not add more info but I hope exame will be useful for future Googlers like me now

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .