mediumMultiple Choice
Permission Denied on Service Startup — Diagnose with namei
A user reports that a service fails to start with the error 'Permission denied'. The service runs under a non-root user. Which command should the administrator use to check if the service has the correct file permissions?
Quick Answer
The answer is the `namei -l /path/to/service` command, because a "permission denied" error on service startup under a non-root user often stems not from the binary itself but from missing execute permissions on any parent directory in the path. The `namei -l` command recursively lists the permissions of every component—from root down to the file—so you can instantly spot a directory that lacks the search bit for the service user, which blocks access even if the binary is correctly set. On the CompTIA Linux+ XK0-005 exam, this question tests your understanding that Linux path resolution requires execute permission on each directory, a common trap where students check only the file’s permissions. A useful memory tip: think of `namei` as "name inspector" that walks the entire directory tree, ensuring no "locked gate" blocks the service user’s path.
⚠ Common exam trap
Many candidates assume `ls -l` or `stat` on the service binary alone is sufficient, overlooking that the 'Permission denied' error often originates from a missing execute bit on a parent directory in the path, which only `namei -l` can reveal by checking every component.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
namei -l /path/to/service
The error 'Permission denied' when starting a service under a non-root user often involves not just the file's own permissions but also the permissions of each directory in the path leading to the service binary. The `namei -l` command recursively lists the permissions of every component in the path, revealing if any parent directory lacks execute (search) permission for the service user, which would block access even if the binary itself is correctly set. This makes it the most comprehensive tool for diagnosing path-based permission issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
namei -l /path/to/service
Why this is correct
`namei -l /path/to/service` resolves every path component and prints each one's owner, group and permission bits, exposing exactly where the non-root service account lacks execute or read access. This directly satisfies the stem's requirement to verify correct file permissions along the full path, not just the final binary.
- ✗
ls -l /path/to/service
Why it's wrong here
ls -l shows the symbolic mode, owner and group of the file, letting the administrator compare them against the service account. It is tempting because it is the everyday listing command, but it omits extended ACL entries that could still deny the non-root user access.
- ✗
getfacl /path/to/service
Why it's wrong here
getfacl shows ACL entries, but if the issue is basic permissions on a directory in the path, it may not show the problem.
- ✗
stat /path/to/service
Why it's wrong here
stat prints metadata including numeric mode, owner and group, but the administrator must decode the octal value manually to judge access for the service account. It is tempting because stat is thorough, yet it does not present the symbolic permissions as directly readable as the standard listing command.
Go deeper
Related to this question
Learn chapter
File Transfer and Remote Access
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on XK0-006
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Given the journalctl output for the httpd service, which of the following is the most likely cause?
hard- ✓ A.The /var/www directory is missing the execute (x) permission for the Apache user
- B.The file /var/www/html/index.html has incorrect SELinux context
- C.The Apache service is running under the wrong user
- D.The file /var/www/html/index.html is missing read permission for the Apache user
Why A: The journalctl output for the httpd service likely shows 'Permission denied' errors when Apache tries to serve files from /var/www. The most common cause is that the /var/www directory lacks the execute (x) permission for the Apache user (typically 'apache' or 'www-data'). Without execute permission on the directory, Apache cannot traverse into it to access files, even if the files themselves have correct permissions. This is a standard Linux permission issue distinct from SELinux or file-level read permissions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.