after a recent dist-upgrade on my debian 9 server I am experimenting several issues with services complaining about missing permissions.
There has not been any major changes on that server but since the upgrade was done apachae, postfix and apt are complaining and refusing to work as intended.
The apache server shows a permission denied on all webpages, the postfix server just dies after a while ("systemctl status postfix" shows the service as active after startup)
apt update complains about permissions too.
Since I have an old snapshot of the server I compared the permissions on the files in question and they all match, therefore I don't know where else to look.
apt update
Hit:1 http://security.debian.org stretch/updates InRelease
Ign:2 http://ftp.de.debian.org/debian stretch InRelease
Hit:3 http://ftp.de.debian.org/debian stretch-updates InRelease
Hit:4 http://ftp.de.debian.org/debian stretch Release
Hit:5 https://download.docker.com/linux/debian stretch InRelease
Error: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.PackageKit was not provided by any .service files
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.
W: Download is performed unsandboxed as root as file '/var/lib/apt/lists/partial/ftp.de.debian.org_debian_dists_stretch_InRelease' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)
ls -l /var/lib/apt/lists/partial/ftp.de.debian.org_debian
ls: cannot access '/var/lib/apt/lists/partial/ftp.de.debian.org_debian': No such file or directory
ls -l /var/lib/apt/lists/
total 108268
-rw-r--r-- 1 root root 39105 Mar 11 04:04 download.docker.com_linux_debian_dists_stretch_InRelease
-rw-r--r-- 1 root root 16254 Feb 28 02:52 download.docker.com_linux_debian_dists_stretch_stable_binary-amd64_Packages
-rw-r--r-- 1 root root 39116092 Mar 10 10:33 ftp.de.debian.org_debian_dists_stretch_main_binary-amd64_Packages
-rw-r--r-- 1 root root 7115196 Jun 16 2017 ftp.de.debian.org_debian_dists_stretch_main_i18n_Translation-de
-rw-r--r-- 1 root root 1347 Jun 16 2017 ftp.de.debian.org_debian_dists_stretch_main_i18n_Translation-de%5fDE
-rw-r--r-- 1 root root 26457271 Mar 10 10:33 ftp.de.debian.org_debian_dists_stretch_main_i18n_Translation-en
-rw-r--r-- 1 root root 33781328 Mar 10 10:33 ftp.de.debian.org_debian_dists_stretch_main_source_Sources
-rw-r--r-- 1 root root 117943 Mar 10 11:22 ftp.de.debian.org_debian_dists_stretch_Release
-rw-r--r-- 1 root root 2434 Mar 10 11:36 ftp.de.debian.org_debian_dists_stretch_Release.gpg
-rw-r--r-- 1 root root 91028 Mar 12 15:35 ftp.de.debian.org_debian_dists_stretch-updates_InRelease
-rw-r--r-- 1 root root 34570 Feb 11 21:45 ftp.de.debian.org_debian_dists_stretch-updates_main_binary-amd64_Packages
-rw-r--r-- 1 root root 2704 Feb 11 21:45 ftp.de.debian.org_debian_dists_stretch-updates_main_binary-amd64_Packages.diff_Index
-rw-r--r-- 1 root root 21713 Jan 29 21:29 ftp.de.debian.org_debian_dists_stretch-updates_main_i18n_Translation-en
-rw-r--r-- 1 root root 2212 Jan 29 21:29 ftp.de.debian.org_debian_dists_stretch-updates_main_i18n_Translation-en.diff_Index
-rw-r--r-- 1 root root 13564 Feb 11 21:45 ftp.de.debian.org_debian_dists_stretch-updates_main_source_Sources
-rw-r--r-- 1 root root 2704 Feb 11 21:45 ftp.de.debian.org_debian_dists_stretch-updates_main_source_Sources.diff_Index
-rw-r----- 1 root root 0 Jul 26 2016 lock
drwx------ 2 _apt root 4096 Mar 12 21:11 partial
-rw-r--r-- 1 root root 62959 Mar 11 20:01 security.debian.org_dists_stretch_updates_InRelease
-rw-r--r-- 1 root root 1868567 Mar 10 22:43 security.debian.org_dists_stretch_updates_main_binary-amd64_Packages
-rw-r--r-- 1 root root 1048251 Mar 10 22:43 security.debian.org_dists_stretch_updates_main_i18n_Translation-en
-rw-r--r-- 1 root root 1022428 Mar 10 22:43 security.debian.org_dists_stretch_updates_main_source_Sources
the partial folder is empty
[Mon Mar 12 20:48:22.711299 2018] [mpm_prefork:notice] [pid 1053] AH00163: Apache/2.4.25 (Debian) OpenSSL/1.0.2l configured -- resuming normal operations
[Mon Mar 12 20:48:22.791915 2018] [core:notice] [pid 1053] AH00094: Command line: '/usr/sbin/apache2'
[Mon Mar 12 20:48:38.739798 2018] [ssl:error] [pid 1113] (13)Permission denied: [client <IP_redacted>:37336] AH01972: could not resolve address of OCSP responder ocsp.int-x3.letsencrypt.org
[Mon Mar 12 20:48:38.739889 2018] [ssl:error] [pid 1113] AH01941: stapling_renew_response: responder error
[Mon Mar 12 20:48:38.778277 2018] [core:error] [pid 1113] (13)Permission denied: [client <IP_redacted>:37336] AH00035: access to / denied (filesystem path '/var') because search permissions are missing on a component of the path
[Mon Mar 12 20:48:38.881378 2018] [core:error] [pid 1113] (13)Permission denied: [client <IP_redacted>:37336] AH00035: access to /favicon.ico denied (filesystem path '/var') because search permissions are missing on a component of the path
Start-Date: 2018-03-11 13:30:41
Commandline: apt-get dist-upgrade
Upgrade: libfdisk1:amd64 (2.29.2-1, 2.29.2-1+deb9u1), libmount1:amd64 (2.29.2-1, 2.29.2-1+deb9u1), util-linux:amd64 (2.29.2-1, 2.29.2-1+deb9u1), mount:amd64 (2.29.2-1, 2.29.2-1+deb9u1), libblkid1:amd64 (2.29.2-1, 2.29.2-1+deb9u1), libuuid1:amd64 (2.29.2-1, 2.29.2-1+deb9u1), libsmartcols1:amd64 (2.29.2-1, 2.29.2-1+deb9u1), bsdutils:amd64 (1:2.29.2-1, 1:2.29.2-1+deb9u1)
End-Date: 2018-03-11 13:31:02
drwxr-xr-x 12 root root 4096 Aug 25 2016 var
drwxr-xr-x 6 root root 4096 Oct 18 2016 www
drwxr-xr-x 5 root root 4096 Mar 12 19:24 html
drwxr-xr-x 2 root root 4096 Oct 18 2016 css
-rw-r--r-- 1 root root 550 Oct 18 2016 subpage.html
drwxr-xr-x 2 root root 4096 Oct 18 2016 img
-rw-r--r-- 1 root root 1321 Oct 18 2016 index.html
drwxr-xr-x 2 root root 4096 Oct 18 2016 js
Can anyone give me a hint on where elso to look for this issue?
This all happened after debian 9.4 was released but I don't think this should be the cause.