Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given: fresh Archlinux VPS box on DigitalOcean. I created a user, 'app', and there's a file, /home/app/webapp.sock created by the binary started by systemd:

Description=Web application server

ExecStart=/home/app/.gem/ruby/2.0.0/bin/thin -d --user app -e production --chdir /home/app/app --socket /home/app/webapp.sock --pid /home/app/ --log /home/app/log/webapp.log start
ExecReload=/bin/kill -HUP $MAINPID
ExecStop=/bin/kill -QUIT $MAINPID


Don't want to run this app as http user, since at some point of time I may decide to run another web server on that machine under a different user, exposing only its .sock file to http user. Rails is known to have security flaws, so I would like to avoid the 'app' user from getting anywhere out of his home folder and its own data.

I have a sudo user, 'sudoer', and there's no way to read even a pid file:

[sudoer@host ~]$ cat /home/app/
cat: /home/app/ Permission denied
[sudoer@host ~]$ sudo su - app
[app@host ~]$ ls -l
-rw-r--r-- 1 app app 5 Dec  7 19:33

It has 'r' rights for 'others', why is that 'sudoer' cannot 'cat' it?

I assume this is the reason for the following nginx errors too. Static file:

2013/12/07 18:58:05 [error] 18114#0: *2 open() "/home/app/app/public/favicon.ico" failed (13: Permission denied), client:, server:, request: "GET /favicon.ico HTTP/1.1", host: ""

Dynamic content:

2013/12/07 20:49:00 [crit] 21581#0: *1 connect() to unix:/home/app/webapp.sock failed (13: Permission denied) while connecting to upstream, client:, server:, request: "GET /favicon.ico HTTP/1.1", upstream: "http://unix:/home/app/webapp.sock:/favicon.ico", host: ""

Excerpt from nginx config:

upstream webapp {
  server unix:/home/app/webapp.sock fail_timeout=0;
server {
  listen 80;
  root /home/app/app/public;

Is that strengthened security? SELinux? CGroups? What am I doing wrong?

share|improve this question
up vote 2 down vote accepted

You must check the permission, not only of the socket (file) but of all the parent directories. If any of them deny access, your request will fail.

For instance:

# ls -ld /home/app
drwx------. 8 root root 4096 Dec 7 21:33 /home/app
share|improve this answer
Yep, right. Sorry for being lame and misunderstanding the basics of permissions. – phil pirozhkov Dec 8 '13 at 1:19
The bare minimum permission you need on this directory is 711 or rwx--x--x. This will prevent others from listing the directory, but they can still read a file if they know its name, and its own permissions permit it. – Michael Hampton Dec 8 '13 at 1:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.