Why can't I access a symlinked directory

Question

I want to (soft)link my .thunderbird dir onto the actual directory which is on a SD card.

Thus,

(xenial)florian@localhost:~$ ls -la /var/host/media/removable/SD\ Card/.thunderbird/
total 24
drwx------.  5 florian florian 4096 May 21 09:23 .
drwxrwxrwx. 10 florian florian 4096 Mar  4 22:42 ..
drwx------.  3 florian florian 4096 Apr  6 13:43 Crash Reports
drwx------. 10 florian florian 4096 May  7 20:39 kps6nx9x.default
drwx------.  2 florian florian 4096 Nov  8  2018 Pending Pings
-rw-rw-r--.  1 florian florian   94 Nov 14  2013 profiles.ini
(xenial)florian@localhost:~$ ls -la .thunderbird 
lrwxrwxrwx. 1 florian florian 47 May 21 09:32 .thunderbird -> /var/host/media/removable/SD Card/.thunderbird/

I changed permissions all the way down to /var/host/media/removable/SD Card:

drwxrwxrwx.  15 root root  4096 Sep 15  2018 var
drwxrwxrwx.  9 root root     4096 Sep 15  2018 host
drwxrwxrwt. 5 root    root     100 May 20 21:22 media
drwxrwxrwx. 10 florian florian 4096 Mar  4 22:42 SD Card

Still, however,

(xenial)florian@localhost:~$ ls .thunderbird 
ls: cannot access '.thunderbird': Permission denied

What is going on here?

Answer 1

Run sudo chmod o-t /var/host/media.

Reference: https://sysctl-explorer.net/fs/protected_symlinks/

This is the problem with your permissions:

drwxrwxrwt. 5 root    root     100 May 20 21:22 media

The t at the end of this means that the directory is sticky.

Quoting from the linked webpage:

When set to "1" symlinks are permitted to be followed only when outside a sticky world-writable directory, or when the uid of the symlink and follower match, or when the directory owner matches the symlink's owner.

---

Another thing, just pointing out something that you don't want to do here:

I changed permissions all the way down to /var/host/media/removable/SD Card:

Not a good idea. Now everybody will be able to read, write, and execute all the files you have under /var. Better to change them back to what they were before (i.e. restore a backup or in dire cases reinstall).