EACCES "Permission denied" while open(2)

guest@ulidtko:~$ id
uid=126(guest) gid=134(guest) groups=134(guest)

guest@ulidtko:~$ ls -ld /home
drwxr-xr-x 8 root root 4096 May 12 19:47 /home

guest@ulidtko:~$ ls -l /home
ls: cannot open directory /home: Permission denied

guest@ulidtko:~$ cat /proc/mounts 
rootfs / rootfs rw 0 0
none /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
none /proc proc rw,nosuid,nodev,noexec,relatime 0 0
none /dev devtmpfs rw,relatime,size=1022396k,nr_inodes=216381,mode=755 0 0
none /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0
/dev/disk/by-uuid/ab0d6ed0-ecbc-4718-be12-cbb3955c1aaf / ext3 rw,relatime,errors=remount-ro,data=ordered 0 0
none /sys/fs/fuse/connections fusectl rw,relatime 0 0
none /sys/kernel/debug debugfs rw,relatime 0 0
none /sys/kernel/security securityfs rw,relatime 0 0
none /dev/shm tmpfs rw,nosuid,nodev,relatime 0 0
none /var/run tmpfs rw,nosuid,relatime,mode=755 0 0
none /var/lock tmpfs rw,nosuid,nodev,noexec,relatime 0 0
none /lib/init/rw tmpfs rw,nosuid,relatime,mode=755 0 0
/dev/sda1 /boot ext2 rw,relatime,errors=continue 0 0
/dev/sda6 /home/max ext3 rw,relatime,errors=continue,data=ordered 0 0
binfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc rw,nosuid,nodev,noexec,relatime 0 0
gvfs-fuse-daemon /home/max/.gvfs fuse.gvfs-fuse-daemon rw,nosuid,nodev,relatime,user_id=1001,group_id=1001 0 0
none /tmp/guest-home.cRIW3S tmpfs rw,relatime,mode=700 0 0
gvfs-fuse-daemon /tmp/guest-home.cRIW3S/.gvfs fuse.gvfs-fuse-daemon rw,nosuid,nodev,relatime,user_id=126,group_id=134 0 0

guest@ulidtko:~$ strace ls -l /home 2>&1 | grep /home -C 6
read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tb"..., 1024) = 346
read(3, "", 1024)                       = 0
close(3)                                = 0
munmap(0xb7711000, 4096)                = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfef7fd8) = -1 EINVAL (Invalid argument)
ioctl(1, TIOCGWINSZ, 0xbfef8130)        = -1 EINVAL (Invalid argument)
lstat64("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lgetxattr("/home", "security.selinux", 0x9c7b268, 255) = -1 ENODATA (No data available)
getxattr("/home", "system.posix_acl_access", 0x0, 0) = -1 EOPNOTSUPP (Operation not supported)
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
--
_llseek(3, 0, [0], SEEK_CUR)            = 0
fstat64(3, {st_mode=S_IFREG|0644, st_size=1382, ...}) = 0
mmap2(NULL, 1382, PROT_READ, MAP_SHARED, 3, 0) = 0xb7711000
_llseek(3, 1382, [1382], SEEK_SET)      = 0
munmap(0xb7711000, 1382)                = 0
close(3)                                = 0
open("/home", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = -1 EACCES (Permission denied)
write(2, "ls: ", 4ls: )                     = 4
write(2, "cannot open directory /home", 27cannot open directory /home) = 27
write(2, ": Permission denied", 19: Permission denied)     = 19
write(2, "\n", 1
)                       = 1
close(1)                                = 0
close(2)                                = 0
exit_group(2)                           = ?

Can anybody explain, why could i be getting this error?

Is this system running a selinux kernel?

What's the user's home directory? From the looks of it there might be a chroot involved.

The user's home is /tmp/guest-home.cRIW3S/

It isn't chrooted, i can see the same files in /, including some my nonstandard directories and symlinks.

This isn't selinux too:

max@ulidtko:~$ uname -a
Linux ulidtko 2.6.32-22-generic #33-Ubuntu SMP Wed Apr 28 13:27:30 UTC 2010 i686 GNU/Linux

But the system is known to be running apparmor, and i'm totally unfamiliar with it. Can it affect the process of opening files/directories?

It's an SElinux alternative that restricts programs based on directory paths. It definitely could.

1 Like

Yes, it was it. Thanks.