Back to problem
Systems Administrator ICoreLinux Permissions~30-40 min

Works as Root

It works when you sudo. Why doesn't it work as the real service account?

Your goal

Your goal is not simply to run one chmod and watch the error disappear. Your goal is to understand how Linux evaluates access for the identity actually doing the work — across every directory in a path, not just the final file — repair the one boundary that's really blocking watchtower, and prove the fix by testing as watchtower itself: showing it can read what it needs, and still cannot write to it or reach a secret it was never meant to see.

Identify
Inspect
Decode
Trace
Repair
Verify

Linux doesn't just organize files into a tree — it also keeps track of WHO is trying to reach them, and what that identity is allowed to do, all the way along the path, not just at the final file.

01

A file existing is not the same question as who may open it

Picture one file, rules.yaml, with two different people trying to open it. Linux never just asks whether the file exists.

It also asks:

  • Who is asking? — the identity of the process making the request
  • What is that identity allowed to do? — read it, write it, or neither

A Linux machine has more than one kind of user:

  • Human accountsalex, maya, deploy
  • Service accountswatchtower, nginx, postgres: an application running under its own restricted identity instead of borrowing someone else's
watchtower probably needs
its own config, its own data, network access, maybe its own logs
vs
watchtower probably does not need
other apps' secrets, user home directories, system passwords, every config file on the box

Giving every application unlimited access would make that second list reachable too. A dedicated, deliberately unprivileged account is what keeps a compromised or buggy service contained to the small list it actually needs.

Knowledge check 0

watchtower is a monitoring service with its own dedicated Linux account.

Why not just run watchtower as your own user, or as root, and skip creating a separate account for it?