Now another area which we might have to try and troubleshoot is file access.
So many things that we need to consider, the user, the groups,
the user belongs to, the file mode, access control lists, and even
mandatory access control lists, such as AppArmor and SELinux, but
also never forget the simple stuff.
The user might not have the correct file name or the correct path, so do
check the simple stuff as well. To gain access to what the user should
have access to, we have the id command. So we can go through and use the
id command and pull out the user id, so we know then the user id that
they're using to access the permissions. And that should be
straightforward enough, as user Bob is going to be accessing files
granted to Bob.
More complex, though, are the groups.
So we can then check for permissions that the user
belongs to as far as groups are concerned.
Don't forget, if you've recently changed group membership,
the user will need to log out and log in again to pick up the group membership.
So check it from both the backend with you doing it as an
administrator, ID Bob, and also from the user's perspective, where
they just type the id command. The output should match.
But also consider this, the number of groups that the user belongs to.
I've had many instances where the user belongs to more than
64 groups, and Linux doesn't like this.
We're going to lose some of those group memberships. So try and keep
your group memberships to as small amount as possible,
but certainly under 64.
The next thing is SELinux, and, of course, SELinux can cause you problems.
I never advocate disabling it, and I never really
advocate putting it into promiscuous mode.
If it's just for user access, we can try and find out what the problem is.
If we go through then and search using ausearch looking for
the module AVC, and if we've then allowed the user to try
recently, within the last 10 minutes,
we can use the ‑ts start recent, and that's in the last 10 minutes.
Check then for any AVC denials of the user then trying to access a resource, and work out from there what you need to do with SELinux.