namei: Checking Path Traversal and Permissions

Luke Hebert

- 2 minutes read - 360 words

When a process cannot read a file deep in a directory tree, the usual suspects are a broken permission somewhere along the path or a symlink that quietly redirects to a different location. The namei utility walks the entire path component by component and prints ownership, mode bits, and link targets in one pass, so you can pinpoint the exact segment causing the problem.

Basic Usage

The two most useful flags are:

  • -m - show the mode (permission) bits for each component
  • -l - resolve and display symbolic links
  • -v - verbose output (includes owner and group)

A typical invocation looks like this:

namei -mo /opt/cloudera/security/jks/
namei -lv /opt/cloudera/security/jks/

Example Output

f: /opt/cloudera/security/jks/
dr-xr-xr-x root           root           /
drwxr-xr-x root           root           opt
drwxr-xr-x cloudera-scm   cloudera-scm   cloudera
drwxr-xr-x root           root           security
drwxr-xr-x root           root           jks

Each line represents one directory in the chain. The first column shows the file type (d for directory, f for file, l for symlink) followed by the permission bits. The next two columns are owner and group. The final column is the component name.

Reading the Output

  • If any directory in the chain lacks x (execute) permission for the user or group that needs to traverse it, access will be denied even if the final file is world-readable.
  • A symlink component will show an l prefix and the target path, which can redirect the traversal to an entirely different subtree.
  • Compare the owner and group on each line against the account that is actually trying to access the file. A mismatch on an intermediate directory is the most common cause of “permission denied” errors that are hard to reproduce with a simple ls -l on the target file alone.

Quick Troubleshooting Checklist

  1. Run namei -lv <path> as the user experiencing the failure.
  2. Scan for any component missing the x bit for that user’s group.
  3. Look for l entries that redirect to a path you did not expect.
  4. Fix the offending directory with chmod or chown, then re-run namei to confirm the chain is clean.

namei is available on most Linux distributions out of the box (part of the util-linux package). No extra installation is needed.