To open a file, a process passes through every directory on the path. If any of them lacks x, the file is closed, whatever its own permissions say.
The kernel checks the path /srv/permissions-lab/archive/note.txt piece by piece: /, srv, permissions-lab, and archive need passage, x, for the process, and note.txt needs the action itself, r. In the previous step the check stopped at archive.
namei with -l prints the permissions of every part of a path at once, one line per directory and one for the file itself:
Look for the denial as the account that needs access. You test someone else's read with sudo -u account — that is how you read the report as www-data. Compare the directory where the denial happens with the triple that applies to that account.
Where the service's path breaks
The web server runs as www-data and must serve /srv/permissions-lab/site/2026/q4/index.html, but it is refused. Do not change any permissions: find the directory www-data cannot pass through and write its full path to ~/answer.txt.
Goals · 0 of 2
- Find the directory where www-data's path breaks and write it to answer.txt not done yet
- Leave the directory permissions as they were not done yet