I can't understand what's not working here:

1) settings

MEDIA_ROOT = '/var/www/satel/media'
MEDIA_URL = 'http://media.satel.culebron'
ADMIN_MEDIA_PREFIX = '/media/'

2) models

class Photo(models.Model):
    id = models.AutoField(primary_key=True)
    name = models.CharField(max_length = 200)
    desc = models.TextField(max_length = 1000)
    img = models.ImageField(upload_to = 'upload')

3) access rights:

drwxr-xrwx  3 culebron culebron 4.0K 2010-04-14 21:13 media
drwxr-xrwx  2 culebron culebron 4.0K 2010-04-14 19:04 upload

4) SQL:

CREATE TABLE "photos_photo" (
    "id" integer NOT NULL PRIMARY KEY,
    "name" varchar(200) NOT NULL,
    "desc" text NOT NULL,
    "img" varchar(100) NOT NULL
);

4) run Django test server as myself.

5) result:

SuspiciousOperation at /admin/photos/author/add/
Attempted access to '/var/www/satel/upload/OpenStreetMap.png' denied.

Not a PIL & jpeg issue, seems not to be access rights issue. But what's wrong?