adminLinux Permission Denied Root Cause Checklist
Permission denied errors are common in Linux administration. They can come from file ownership, mode bits, directory execute permission, ACLs, service users, mount options, SELinux or wrong paths.
Core principle
Permission troubleshooting starts by identifying who is trying to access what. A command run as root, a service running as www-data and a user shell session do not have the same access.
Checklist
- Identify the exact permission denied error.
- Identify the user or service that triggered it.
- Check file ownership.
- Check file permission bits.
- Check parent directory execute permission.
- Check group membership.
- Check ACL rules if used.
- Check mount options if relevant.
- Check SELinux context on Red Hat systems.
- Apply the minimum permission fix and retest.
Reusable lesson
This applies to WordPress uploads, Nginx 403 errors, PHP-FPM access, backup scripts, deployment users, database dumps and log files.
When to Use This Checklist
Use this checklist when a Linux command, website, service or script fails with permission denied.
Required Tools
SSH access, ls, id, getfacl, mount, service user, logs, SELinux tools if relevant
Before You Start
Do not fix permission denied with chmod 777. Find the exact user and access requirement first.
Structured Checklist Steps
- Capture error.
- Identify acting user.
- Check ownership.
- Check mode bits.
- Check parent directory access.
- Check group membership.
- Check ACL.
- Check mount options.
- Check SELinux if relevant.
- Apply minimum fix.
Verification Steps
- Acting user is known.
- Target path is correct.
- Required permission is granted.
- Unnecessary broad permission is avoided.
- Error no longer appears.
Rollback Plan
If a permission fix creates new risk or breaks access, restore the previous owner, group or mode and redesign with least privilege.
Common Mistakes
- Using chmod 777.
- Forgetting parent directory execute permission.
- Fixing the wrong path.
- Ignoring service user.
- Ignoring SELinux on Red Hat systems.
Related Commands
whoami
id www-data
ls -ld /var/www/example.com
ls -la /var/www/example.com/wp-content
getfacl /var/www/example.com/wp-content
mount | grep /var/www
getenforce
ls -Z /var/www/example.com