It seems that Apache needs at least read and execute permission to all the sub-directories of a path in order to serve the files in the directory.

Does anyone have a script or one-liner that could verify this?

I was thinking perhaps a bash script that will su - apache and then attempt to navigate to each directory in the path. I'm going to try some things out and I'll post if I come up with something that works.

4 Answers 4


For Debian:

sudo -u www-data test -r /path/to/file && echo ok
  • Does this test fail if you do not have access to /path/to but have access to /path/to/file. This is what I'm trying to test. Mar 4, 2012 at 22:12
  • Outstanding. My tests show that it does exactly what I need! Mar 4, 2012 at 22:14
  • Please be aware that -r is for files only. If you need to know if Apache is capable of doing a DirectoryIndex on a folder, test -rx. /cc @conrad-shultz
    – Luis Bruno
    Mar 4, 2012 at 22:25


# testperms.sh

if [ -r $1 ];
   then echo "Can read file!";
   echo "Cannot read file!";


 shultzc@lithium:~$ ./testperms.sh /etc/ssl
 Can read file!
 shultzc@lithium:~$ ./testperms.sh /etc/ssl/private
 Cannot read file!

You should be able to adapt that code to your needs. In combination with sudo it can be used easily to test accessibility of files within directories with +x permissions only (such as many home directories), e.g.:

 shultzc@lithium:~$ sudo -u www-data ./testperms.sh /home/shultzc/testperms.sh
 Can read file!
 shultzc@lithium:~$ sudo -u www-data ./testperms.sh /home/shultzc
 Cannot read file!
  • sudo -u www-data test -r /path/to/file
    – Luis Bruno
    Mar 4, 2012 at 22:04
  • 1
    @LuisBruno Ah, brilliant! Mar 4, 2012 at 22:07
  • To be honest, I was going to use other flags for test, then I read your script and bitch-slapped myself. Anyway, both our scripts fail for the drwx-----x case.
    – Luis Bruno
    Mar 4, 2012 at 22:14

This is what I got (must be run as a user that could su - <test user>:



for dir in $2; do

   # Set directory to test
   if [[ $CWD == '/' ]]

   # Test if user has access
   if !(su - $1 -c "cd $CWD" 2> /dev/null)
      echo "$CWD - No access for $1"
      exit -1

echo "Access for $1 all the way through $2"
  • Way more complicated than required... :-) Mar 4, 2012 at 21:58
  • Figured heh. That's why I came to SF. Seems like Luis beat us all on this one! Mar 4, 2012 at 22:14

The following find commands should be run as root, or at least a user that has full access to the directory tree. You will need an additional check to verify access to the paths used in the find commands. This can be accomplished by running the command as the target user. Failures when running as a non-root user should be dealt with appropriately.

Replace /srv/www with the appropriate directory or directories for your requirements. Change the user and group appropriately for other users. If the user belongs to multiple groups, you will need to add additional tests for the secondary groups. (In many cases just flagging files owned by the secondary groups may be sufficient.)

For a system where apache runs as www-data:www-data the following will find files which can't be read.

find /srv/www ! -type d ! \( -user www-data -perm -400 \) -a ! \( -group www-data -perm -040 \) -a ! -perm -004

The equivalent for accessible directories is:

find /srv/www -type d ! \( -user www-data -perm -500 \) -a ! \( -group www-data -perm -050 \) -a ! -perm -005

For directories that don't need to be listed use 1 instead of 5 in the above. Files with known names will be accessible, but auto-index generation won't be.

You may also want to ensure only a few files or directories can be written to. The following finds files and directories that can be written too.

find -L /srv/www \( -user www-data -perm -200 \) -o \( -group www-data -perm -020 \) -a -perm -002

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.