Debian 12 – backup job fails with permission denied errors – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Backups fail silently or partially, creating recovery risk and compliance exposure.

Environment & Reproduction

Common after ownership changes, mount option updates, or credential rotation.

tail -n 80 /var/log/.log 2>/dev/null || true
mount | head -n 40
id

Root Cause Analysis

Backup runtime user lacks read permissions, ACL grants, or mount write access.

Quick Triage

Identify failing paths and effective user context.

namei -l /path/to/source
getfacl /path/to/source 2>/dev/null || true
sudo -u  test -r /path/to/source && echo ok || echo fail

Step-by-Step Diagnosis

Audit permission inheritance and destination mount policy.

grep -RIn "permission denied|access denied" /var/log 2>/dev/null | tail -n 30
find /path/to/source -maxdepth 2 -type d -printf '%M %u %g %pn' | head
mount | grep -E 'backup|nfs|cifs'

Solution – Primary Fix

Grant required ownership/ACL access and rerun backup under service account.

sudo chown -R : /path/to/source
sudo setfacl -R -m u::rx /path/to/source
sudo -u  /usr/local/bin/.sh

Solution – Alternative Approaches

Use dedicated read-only bind mounts for backup scope isolation.

sudo mkdir -p /backup-source
sudo mount --bind /path/to/source /backup-source
sudo mount -o remount,ro,bind /backup-source

Verification & Acceptance Criteria

Backup completes with expected file count and no permission errors.

tail -n 80 /var/log/.log 2>/dev/null || true
find /backup/destination -type f | wc -l
grep -i 'permission denied' /var/log/.log 2>/dev/null || true

Rollback Plan

Revert ACL and ownership changes if application access regresses.

sudo setfacl -Rb /path/to/source
sudo chown -R : /path/to/source
mount | grep backup

Prevention & Hardening

Document backup identity and verify read/write checks before scheduled runs.

id 
namei -l /path/to/source
crontab -l

Related Errors & Cross-Refs

Related to expired credentials, read-only mounts, and changed UID/GID mappings.

Related tutorial: View the step-by-step tutorial for Debian 12.

View all Debian 12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian ACL, filesystem permissions, and backup operations references.