Before you start
GNU/Linux; namei comes from util-linux and getfacl from ACL tools. SELinux checks apply only where installed.
Commands are examples, not actions run by this page. Replace the sample names and paths. Run related blocks in the same shell. Read the explanations before copying. Logs and configuration can contain private data; keep credentials and unredacted evidence out of public posts.
Validation: documentation-reviewed guidance, not a tested live-cluster repair.
A web service cannot read a configuration file that you can open in your administrator shell. Your shell and the service are different security subjects. Giving everyone access may hide that difference while exposing data.
1. Check the caller and the whole path
Replace the example path. id describes your current shell, not an unrelated service. For a daemon, establish its configured user and the running worker identity separately. A process may also see a different root or mount namespace.
FILE="/path/to/file"
id
namei -l -- "$FILE"
stat -- "$FILE"
getfacl -p -- "$FILE"Inspect the parent directories as well as the target. Read ACL effective-permission comments instead of interpreting the visible mode bits alone.
| What you observe | What it suggests | Next step |
|---|---|---|
| A parent directory lacks search permission for the caller | The process cannot reach the file. | Review the narrowest authorized traversal permission; changing the file itself will not fix this. |
| A named ACL entry has a restrictive effective mask | The ACL mask limits the entry’s effective rights. | Have the owner review the entry and mask together; expanding the mask can affect several entries. |
| Your shell can read it but the service cannot | The failing identity or confinement differs. | Inspect service identity, namespace, and security-policy evidence. |
2. Distinguish Linux permissions from SELinux policy
On an SELinux system, keep enforcing enabled. Correlate the actual failure time and path with audit evidence; Permission denied alone does not prove SELinux is responsible. Audit logs can include sensitive system details.
If the installed policy expects a different label, a dry-run label check can show the proposed correction. For custom content locations, the intended persistent mapping must be designed first; an arbitrary relabel is not a general fix.
getenforce
ls -Zd -- "$FILE"
matchpathcon -V "$FILE"
restorecon -n -v "$FILE"These checks do not change the label. matchpathcon can return a nonzero status for a mismatch; read the message. A missing tool does not establish that policy permits access.
3. Make one least-privilege correction
Write down the intended user, group, operation, and path before proposing a change. A service that needs read access does not automatically need write or execute permission. Directory execute means traversal, which is different from executing a regular file.
Preserve the existing ownership, mode, ACL, and context in a private change record. Have the data owner approve a targeted owner/group, mode, ACL, or policy-label correction in the configuration source. Review what an ACL-mask adjustment would grant to other users.
Test the same operation through the same service or user, not a root-only test. Keep an authorized rollback for that one object; do not recursively rewrite an entire application tree.
Verify the fix
- Repeat the denied operation as the original user or service.
- Verify intended access succeeds and an unauthorized identity still cannot read the data.
- Check that SELinux remains enforcing and the fix persists through the normal deployment process.
Record the evidence, approved change, result, and rollback plan so the next administrator can follow your reasoning.
Avoid these shortcuts
- Do not apply chmod 777, broad recursive chown, or disable SELinux.
- Do not assume changing your shell’s groups changes already-running service processes.
- Do not publish full ACLs, paths, or audit records containing private details.
Primary sources and version checks
Check the documentation for your installed release. Provider, runtime, CNI, storage-driver, and distribution details can differ.