Linux · 2 steps

Permission denied

Walk the whole path, then the layers most people forget: ACLs, SELinux, capabilities, mount options and namespaces.

Every step

Check every directory in the path, not just the file

Reaching a file needs execute permission on every directory above it. A perfect 644 on the file is irrelevant if a parent directory is missing its x bit for you.

$ namei -l /full/path/to/file

$ ls -la /full/path/to/

$ id <user> # the identity that actually matters, not yours

$ sudo -u <user> test -r /full/path/to/file && echo readable || echo denied

Look for: namei prints every component with its mode and owner. Find the first line where the user lacks x on a directory, or r on the file.

Check the layers above plain permissions

Unix modes are only the first gate. ACLs, SELinux, AppArmor, mount options and file attributes all deny independently, and none of them show up in ls.

$ getfacl /path/to/file

$ ls -Z /path/to/file # SELinux label

$ ausearch -m avc -ts recent # SELinux denials

$ dmesg -T | grep -i -E "apparmor|denied"

$ lsattr /path/to/file # immutable bit

$ mount | grep -E "noexec|nosuid|ro,"

Look for: A `+` at the end of the ls mode means an ACL exists. AVC denials name the exact context that was refused.