Files have more attributes than
ls -l shows. For example, many filesystems have several 'flag' attributes to change the file's behavior (visible in
lsattr) and many can store arbitrary data in the form of extended attributes (visible in
Linux is also not limited to just three classes of permissions; a file can have a list of users and groups assigned to it – this would be indicated by a plus sign
+ next to standard permissions, and the whole list would be visible in
But in this case here, the dot
. next to file permissions indicates that the file has a security context label applied to it, which indicates the file's purpose. You should be able to see this parameter in
ls -Z and it's used by "Mandatory Access Control" modules – usually SELinux or sometimes SMACK – to enforce limits on which processes can access it even if the owner has set them to world-readable.
While SELinux can often automatically apply the correct label to files based on what directory they're created in, this does not work when the file was originally created elsewhere and only later moved into the final location. So if you run
ls -lZ you'll probably see that the inaccessible file has a completely different label than the rest.
To fix this, you should be able to run
restorecon on the file, which will set the correct context according to installed SELinux policy.