Tomcat 7 + Railo 3.3: java.io.FileNotFoundException: /opt/railo/lib/railo-server/patches/3.1.2.001.rc (Permission denied)

/var/log/tomcat-7/catalina.2011-09-05.log:

INFO: Starting service Catalina
Sep 5, 2011 8:33:51 PM org.apache.catalina.core.StandardEngine startInternal
INFO: Starting Servlet Engine: Apache Tomcat/7.0.21-gentoo
Sep 5, 2011 8:33:53 PM org.apache.catalina.core.StandardContext loadOnStartup
SEVERE: Servlet  threw load() exception
java.io.FileNotFoundException: /opt/railo/lib/railo-server/patches/3.1.2.001.rc (Permission denied)
        at java.io.FileOutputStream.open(Native Method)
        at java.io.FileOutputStream.<init>(FileOutputStream.java:194)
        at java.io.FileOutputStream.<init>(FileOutputStream.java:145)
        at railo.loader.engine.CFMLEngineFactory.initEngine(CFMLEngineFactory.java:222)
        at railo.loader.engine.CFMLEngineFactory.getEngine(CFMLEngineFactory.java:171)
        at railo.loader.engine.CFMLEngineFactory.getInstance(CFMLEngineFactory.java:72)
        at railo.loader.engine.CFMLEngineFactory.getInstance(CFMLEngineFactory.java:111)
        at railo.loader.servlet.CFMLServlet.init(CFMLServlet.java:26)
        at org.apache.catalina.core.StandardWrapper.initServlet(Unknown Source)
        at org.apache.catalina.core.StandardWrapper.loadServlet(Unknown Source)
        at org.apache.catalina.core.StandardWrapper.load(Unknown Source)
        at org.apache.catalina.core.StandardContext.loadOnStartup(Unknown Source)
        at org.apache.catalina.core.StandardContext$3.call(Unknown Source)
        at org.apache.catalina.core.StandardContext$3.call(Unknown Source)
        at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
        at java.util.concurrent.FutureTask.run(FutureTask.java:138)
        at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
        at java.lang.Thread.run(Thread.java:662)

However...

# ls -la /opt/railo/lib/railo-server/patches/3.1.2.001.rc
-rw-rw-r-- 1 tomcat web 6497683 Mar  3  2010 /opt/railo/lib/railo-server/patches/3.1.2.001.rc

Looks pretty accessible to me, tomcat can read and write it, so exactly what does "permission denied" mean in this situation?

I though it might relate to permissions on the site root or WEB-INF folder but they look fine as well:

# ls -la /www/mysite/site/        
drwxrwxr-x  8 root web     4096 Sep  5 20:43 .
drwxr-xr-x 15 me web     4096 Aug 18 13:01 ..
drwxr-xr-x  4 tomcat tomcat  4096 Sep  5 20:43 WEB-INF

Setup is Tomcat 7 + Railo 3.3 (previously upgraded from 3.1.2 while under resin) running on Gentoo Linux with Apache 2.2.20 running as user tomcat in the web group.

/etc/tomcat-7/catalina.properties: common.loader=${catali开发者_如何学Pythonna.base}/lib,${catalina.base}/lib/*.jar,${catalina.home}/lib,${catalina.home}/lib/*.jar,/opt/railo/lib,/opt/railo/lib/*.jar

/etc/tomcat-7/server.xml:

<Host name="mysite.myhost" appBase="webapps"
     unpackWARs="true" autoDeploy="true"
     xmlValidation="false" xmlNamespaceAware="false">
     <Context path="" docBase="/www/mysite/site" />
        <Logger className="org.apache.catalina.logger.FileLogger"/>
</Host>