Read a permission denial down to its cause

short · 30 min · Objective 5.4

Task

"Permission denied" has at least four distinct causes on a modern Linux box, and they need four different fixes. Practise telling them apart against planted faults, so that you reach for the right one instead of the reflex chmod 777 that turns a security control into an outage waiting to happen.

Steps

  1. File mode: a process cannot read a file. Check ls -l, confirm the mode excludes the caller's class, and read the mode as owner/group/other. Fix with the narrowest chmod that grants exactly what is needed.
  2. Ownership: the mode looks fine but access still fails. Check id of the process user against the file owner and group; the caller is in neither class, so "other" applies. Fix with chown/chgrp, not a mode change.
  3. SELinux: mode and ownership are both correct and it STILL fails. This is the one the reflexive fixes never solve. Check ausearch -m avc -ts recent or journalctl for an AVC denial, read the context with ls -Z, and fix with restorecon or the correct semanage fcontext rule -- never by disabling SELinux.
  4. ACL: ls -l shows a trailing +. Standard mode is not the whole story; read the real permissions with getfacl and fix with setfacl.
  5. For each, name the single command that revealed the cause.

Verify

ls -lZ /srv/app/data        # mode, owner, AND SELinux context in one line
getfacl /srv/app/data       # the + in ls -l means the answer is here
ausearch -m avc -ts recent 2>/dev/null | tail -5   # SELinux denials, if any

ls -lZ is the fast triage: it shows mode, owner and context together, so you can rule three causes in or out at a glance. An AVC line in ausearch while mode and ownership are correct is the signature of an SELinux denial, and it is the case where chmod/chown will change nothing.

Notes

The instinct to run chmod 777 when access fails is the habit this lab exists to break: it does not fix an SELinux or ownership problem, it just removes a control, and it frequently leaves the original denial in place while opening the file to everyone. Diagnose the layer first -- mode, owner, context, ACL -- then apply the narrowest fix for that layer.