Ttyjfyk

I encounter a strange problem on a unix/linux machine:

I'm member of a group, let's call it group A and a certain file (which has a different owner) belongs to group A as well. The permissions of that file are

-rw-rw----

so I'd expect I should be able to open that file, but I am not: I'll get the "Permission denied" error message when I try to look at the file's content (using cat).

Since the permissions seem to be correct, what else could be causing this? Are there "overriding" permission restrictions in place? If so, how would I find out?

Have you logged out and logged back in again since you were added to group A ?

If not, your current login processes will only have the group memberships that it had at the time of login, not any changes since. And any child processes of that login will have the same group memberships (i.e. if you logged into X then every application including your terminal emulator and shell)

You can test this by logging in again on another console or via ssh, or something like exec sudo -u $(id -u -n) -i (to effectively kill and replace the current shell with a new shell - any background processes belonging to that shell will be orphaned)

With NFS, it depends which security mode you use, but in the traditional one, the list of groups the user belongs to is sent by the client to the server, and there's a limit on the number of groups that can be sent (it was 16 the last time I checked).

So, the client says: I'm uid 1234 and by the way I'm member of groups 12, 13, 14... If you're in more than 16 groups, that list will be truncated and there will be groups for which the server is not aware you're a member of it.

That's probably the explanation for it. Only the system administrator of the local and/or remote machine can do something about that either by changing the security model or the setting of the NFS server or by reducing the number of groups you're a member of.

Could be ACLs. See

getfacl the-file

Could be that for some reason, the groups you're meant to be in is not properly set. Check with

id -a

What about

namei -xl "$(readlink -f the-file)"

getfattr -dm- the-file

sudo lsattr the-file

What's the type of the filesystem it resides in?

Any apparmor, SELinux or any other mandatory access control in place in the system?

You're sure the file doesn't contain the text "Permission denied", right ;-) ?

As you note in a comment, you don't have read permissions to /home/username. But to read /home/username/path1/path2/file, you need execute permissions for the whole path.

To debug this, run namei -l /home/username/path1/path2/file as the user who reads the file.