Ubuntu – How to Edit Apache2.conf | Permission Denied – Amazon AWS (EC2)

Here's another scenario that would cause the problem

chris@chris-desktop:~$ sudo cp Downloads/Ankit.pdf Desktop/Ankit.pdf
[sudo] password for chris: 
chris@chris-desktop:~$ ls -l Desktop/Ankit.pdf 
-rw-r--r-- 1 root root 19769 Jan 11 05:52 Desktop/Ankit.pdf
chris@chris-desktop:~$ cp Downloads/Ankit.pdf Desktop/Ankit.pdf
cp: cannot create regular file `Desktop/Ankit.pdf': Permission denied

In this case I already created a file in the destination directory with sudo so that it was owned by root. The file can not be overwritten by a normal cp command as user and results in a 'Permiision denied' error.

/opt/tomcat is declared to be the home directory of the tomcat user, but belongs to the root user (with the tomcat user not having write permissions).

Scrubbing the tutorial, especially the permissions section, I have mixed feelings towards the quality of the tutorial. It speaks about "giv[ing] the tomcat user write access to the conf directory" while changing the folder's permissions. Not having write permissions for the web application server's user to the software ran seems reasonable for production use (an attacker exploiting the tomcat process will not be able to modify software), this will also prevent you from deploying applications from withing the tomcat web application manager.

I'd go for setting up tomcat as the webapps group:

chgrp -R tomcat /opt/tomcat/webapps

and when you need to deploy new applications, add write permissions for that group:

chmod -R g+w /opt/tomcat/webapps

which you remove again after deployment:

chmod -R g-w /opt/tomcat/webapps

(you will need to run those commands with super user privileges, so prefix sudo as needed). This would also fit the Tomcat Security Considerations HowTo.