{"record":{"id":"00dacc6d8bfe19a7","repo":"libnyanpasu/clash-nyanpasu","slug":"stderr","errorCode":null,"errorMessage":"{stderr}","messagePattern":"\\{stderr\\}","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/tauri/src/core/manager.rs","lineNumber":52,"sourceCode":"        let sudo = match Command::new(\"which\").arg(\"pkexec\").output() {\n            Ok(output) => {\n                if output.stdout.is_empty() {\n                    \"sudo\"\n                } else {\n                    \"pkexec\"\n                }\n            }\n            Err(_) => \"sudo\",\n        };\n\n        Command::new(sudo).arg(\"sh\").arg(\"-c\").arg(shell).output()?\n    };\n\n    if output.status.success() {\n        Ok(())\n    } else {\n        let stderr = std::str::from_utf8(&output.stderr).unwrap_or(\"\");\n        anyhow::bail!(\"{stderr}\");\n    }\n}\n\n#[allow(unused)]\npub fn escape(text: &str) -> Cow<'_, str> {\n    let bytes = text.as_bytes();\n\n    let mut owned = None;\n\n    for pos in 0..bytes.len() {\n        let special = match bytes[pos] {\n            b' ' => Some(b' '),\n            _ => None,\n        };\n        if let Some(s) = special {\n            if owned.is_none() {\n                owned = Some(bytes[0..pos].to_owned());\n            }","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/libnyanpasu/clash-nyanpasu/blob/f7dbce2997c633e484f54788035e770b3ee99773/backend/tauri/src/core/manager.rs#L34-L70","documentation":"`grant_permission` escalates privileges for the core binary (osascript on macOS, pkexec/sudo setcap on Linux) and, when the elevated command exits non-zero, fails with the raw stderr of that command. The message is entirely the child process' stderr, so the text varies (e.g. auth dialogs cancelled, sudo password failures, setcap errors).","triggerScenarios":"Calling `grant_permission(path)` where the `osascript`/`sudo`/`pkexec` child exits non-zero: user cancels the UAC-like prompt, password entry fails, the path contains unescaped characters, or setcap is unavailable.","commonSituations":"Linux systems without policykit configured; user cancels the macOS administrator prompt; sudo requires a TTY; binary path has spaces on systems where escaping is insufficient; running in environments where the sudo helper is missing.","solutions":["Read the returned stderr to identify the actual OS-level failure (cancelled prompt vs. command error) and retry with the prompt accepted.","Verify pkexec/polkit or sudo is available and configured on the system, or run the app with sufficient privileges already.","Re-run after correcting the binary path (spaces/special characters) that broke the elevated shell command."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"let which = Command::new(\"which\").arg(\"sudo\").output()?;\nif !which.status.success() { return Err(anyhow::anyhow!(\"no privilege-escalation helper available\")); }","typeGuard":null,"tryCatchPattern":"match grant_permission(&core_path) {\n    Err(e) => {\n        let stderr = e.to_string();\n        if stderr.contains(\"User canceled\") || stderr.contains(\"canceled\") {\n            log::info!(\"user declined elevation\");\n        } else {\n            return Err(anyhow::anyhow!(\"grant_permission failed: {stderr}\"));\n        }\n    }\n    Ok(()) => {}\n}","preventionTips":["Detect user-cancelled prompts (macOS 'User canceled', pkexec dismissal) and treat them as benign.","Check for pkexec/sudo availability before invoking grant_permission.","Avoid paths with spaces/special characters for the core binary, or test escaping on the target platform.","If the app already runs as root/admin, skip the escalation step entirely."],"tags":["process","permissions","linux","macos"],"backgroundTag":"permission-denied","analyzedSha":"f7dbce2997c633e484f54788035e770b3ee99773","analyzedAt":"2026-09-08T01:24:59.197Z","contentChangedAt":"2026-09-08T01:24:59.197Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}