I encounter a strange problem on a unix/linux machine:

I'm member of a group, let's call it group A and a certain file (which has a different owner) belongs to group A as well. The permissions of that file are


so I'd expect I should be able to open that file, but I am not: I'll get the "Permission denied" error message when I try to look at the file's content (using cat).

Since the permissions seem to be correct, what else could be causing this? Are there "overriding" permission restrictions in place? If so, how would I find out?

  • 2
    What about directory permissions? – Karlson Oct 13 '12 at 18:04
  • If you are in multiple groups, is your current group set to A? – Code-Guru Oct 13 '12 at 19:49
  • 2
    @Karlson, if directory permissions were the issue, you wouldn't be able to see the file's permissions in the first place. – cjm Oct 13 '12 at 22:02
  • Show us the full path and filename please. – jippie Oct 14 '12 at 9:13
  • It's in /home/theotheruser/somefolder/bla.txt I am in multiple groups. – Lagerbaer Oct 14 '12 at 18:31

Have you logged out and logged back in again since you were added to group A ?

If not, your current login processes will only have the group memberships that it had at the time of login, not any changes since. And any child processes of that login will have the same group memberships (i.e. if you logged into X then every application including your terminal emulator and shell)

You can test this by logging in again on another console or via ssh, or something like exec sudo -u $(id -u -n) -i (to effectively kill and replace the current shell with a new shell - any background processes belonging to that shell will be orphaned)

  • No, that wasn't the problem; I logged out and back in and that didn't resolve it. – Lagerbaer Oct 14 '12 at 18:37

As you note in a comment, you don't have read permissions to /home/username. But to read /home/username/path1/path2/file, you need execute permissions for the whole path.

To debug this, run namei -l /home/username/path1/path2/file as the user who reads the file.

  • That was the problem in my case. I wanted to give another user rights to operate on the subfolder of my home dir, but my home dir has access 700, so they got "Permission denied" for any command. – Cerberus Oct 14 '19 at 3:49

With NFS, it depends which security mode you use, but in the traditional one, the list of groups the user belongs to is sent by the client to the server, and there's a limit on the number of groups that can be sent (it was 16 the last time I checked).

So, the client says: I'm uid 1234 and by the way I'm member of groups 12, 13, 14... If you're in more than 16 groups, that list will be truncated and there will be groups for which the server is not aware you're a member of it.

That's probably the explanation for it. Only the system administrator of the local and/or remote machine can do something about that either by changing the security model or the setting of the NFS server or by reducing the number of groups you're a member of.

  • I have a strong feeling that this is the reason, because the group I'm appears at position 19 in the output of the "groups" command. I'll show this answer to the sys admin and see if it helps. :) – Lagerbaer Oct 15 '12 at 16:21
  • How would you change the "security model" on NFS to solve this? – Danny Mar 28 '17 at 5:26

Could be ACLs. See

getfacl the-file

Could be that for some reason, the groups you're meant to be in is not properly set. Check with

id -a

What about

namei -xl "$(readlink -f the-file)"

getfattr -dm- the-file

sudo lsattr the-file

What's the type of the filesystem it resides in?

Any apparmor, SELinux or any other mandatory access control in place in the system?

You're sure the file doesn't contain the text "Permission denied", right ;-) ?

  • Nope, there's no special ACL, it just repeats what the standard flags tell me, and id -a tells me that I am in that file's group – Lagerbaer Oct 13 '12 at 17:56
  • The weird thing is, I can see the files of another user belonging to group B, of which I'm also a member... – Lagerbaer Oct 14 '12 at 18:38
  • File system appears to be nfs4. namei gives me / and home belonging to root, root. /home/username belonging to username and group X (of which I am not a member), then the rest is /home/username/path1/path2/file where path1 belongs to username and group X, and path2 belongs to username, and group A, of which I'm a member. – Lagerbaer Oct 15 '12 at 1:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.