The file's permissions are right and it still cannot be read

Release deploys stopped going through. The script runs as the service user deploy and fails at the very first step: it cannot read its configuration. The permissions on the file look entirely ordinary.

The symptom

As root the script works; as deploy it does not. The file it fails on is readable by everyone.

$ sudo /opt/release/publish.sh
published r-7731

$ sudo -u deploy /opt/release/publish.sh
grep: /srv/config/app.conf: Permission denied
publish: cannot read /srv/config/app.conf

$ sudo ls -l /srv/config/app.conf
-rw-r--r-- 1 root appcfg 36 Aug 18 09:14 /srv/config/app.conf

The string -rw-r--r-- is mode 644, and it means "anyone may read". And still it cannot be read. So this file is not where the problem is.

What you have to end up with

Four conditions. /opt/release/publish.sh, run as the deploy user, prints the line with the release token. Nothing was opened up to 777: giving everyone everything is not a repair, it is a new problem. The contents of /srv/config/app.conf are unchanged: rewriting the configuration to get around permissions is not the answer. And the script itself is unchanged: permissions are what gets fixed, not the program that ran into them.

How to work through "Permission denied"

First: find out exactly who the failing thing runs as, and what groups they are in. id deploy<