Can't read file even though permissions are correct

Question

I have a dir with read permissions for ssl-cert:

root@yellowstone:~/certs# ls -lah
total 28K
drwxr-x--- 2 root ssl-cert 4.0K Oct 23 16:58 .
drwx------ 7 root root     4.0K Oct 23 17:20 ..
-rw-r--r-- 1 root ssl-cert 2.0K Oct 23 16:58 certificate1.crt
-rw-r--r-- 1 root ssl-cert 2.0K Oct 23 16:58 certificate2.crt
-rw-r--r-- 1 root ssl-cert 2.0K Oct 23 16:58 certificate3.crt
-rw-r----- 1 root ssl-cert 3.2K Oct 23 16:58 privatekey.key
-rw-r--r-- 1 root ssl-cert 2.0K Oct 23 16:58 certificate4.crt

I have an user in the group ssl-cert:

root@yellowstone:~/certs# id prosody 
uid=116(prosody) gid=124(prosody) groups=124(prosody),115(ssl-cert)

But if I try to access either the dir or a file in it I get "Permission denied":

prosody@yellowstone:/$ cd /root/certs
bash: cd: /root/certs: Permission denied
prosody@yellowstone:/$ cat /root/certs/certificate4.crt
cat: /root/certs/certificate4.crt: Permission denied
prosody@yellowstone:/$ cat /root/certs/privatekey.key
cat: /root/certs/privatekey.key: Permission denied

What do I have to change to access the files as user prosody?

Solution

You need to put the files in some other directory, not under /root. Such files are intended to be accessed only by the system administrator, and it's a very bad idea to allow any other user to get in there.

As you can clearly see from your directory listing, the permissions on /root allow only root to read and write that directory. All others have no permissions at all. This is why user prosody cannot traverse that directory.

drwx------ 7 root root     4.0K Oct 23 17:20 ..

Comments

[Adnidor]

OK, thanks, putting in in another directory fixed it.

[Adnidor]

But why can't I cat the file? Why do I need permissions to traverse all parent directorys for that?

[HBruijn]

Yes, the effective UID/GID needs sufficient permissions on the whole path, not just the file.