{"record":{"id":"03b8d6dcad961a0e","repo":"langchain-ai/deepagents","slug":"temporary-artifact-permissions-are-too-broad","errorCode":null,"errorMessage":"temporary artifact permissions are too broad","messagePattern":"temporary artifact permissions are too broad","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/auto_mode.py","lineNumber":1062,"sourceCode":"    file_descriptor, raw_path = tempfile.mkstemp(\n        prefix=_TEMP_ARTIFACT_PREFIX,\n        suffix=suffix,\n        dir=temp_root,\n    )\n    file_path = Path(raw_path)\n    complete = False\n    try:\n        file_stat = _write_temp_artifact_bytes(file_descriptor, data)\n        if not stat.S_ISREG(file_stat.st_mode):\n            msg = \"temporary artifact is not a regular file\"\n            raise OSError(msg)\n        getuid = getattr(os, \"getuid\", None)\n        if callable(getuid) and file_stat.st_uid != getuid():\n            msg = \"temporary artifact is not owned by this user\"\n            raise OSError(msg)\n        if os.name != \"nt\" and stat.S_IMODE(file_stat.st_mode) & 0o077:\n            msg = \"temporary artifact permissions are too broad\"\n            raise OSError(msg)\n        artifact = AutoTempArtifact(\n            allocation_id=uuid4().hex,\n            file_path=str(file_path),\n            thread_key=thread_key,\n            turn_id=turn_id,\n            created_by_tool_call_id=tool_call_id,\n            file_device=file_stat.st_dev,\n            file_inode=file_stat.st_ino,\n        )\n        complete = True\n        return artifact\n    finally:\n        with contextlib.suppress(OSError):\n            os.close(file_descriptor)\n        if not complete:\n            with contextlib.suppress(OSError):\n                file_path.unlink()\n","sourceCodeStart":1044,"sourceCodeEnd":1080,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/auto_mode.py#L1044-L1080","documentation":"Raised by `_allocate_temp_artifact` when, on POSIX (`os.name != 'nt'`), the temp artifact's mode grants any access to group or other (`stat.S_IMODE(st_mode) & 0o077` is nonzero). `mkstemp` creates files with mode 0600, so this signals the environment (typically the process umask or a temp filesystem) widened the permissions of the artifact.","triggerScenarios":"Calling `create_temp_artifact` when the resulting temp file's mode is broader than 0600 — e.g. an unusual umask forcing extra bits, a temp filesystem (some containers, macOS default temp handling, or admin-configured mounts) that ORs in group/other permissions, or interception of the created file.","commonSituations":"Containers or CI images with a permissive umask (e.g. umask 000) that affects `mkstemp` behavior on certain filesystems; tmpfs mounts with forced ACLs/masks; security tooling that modifies newly created file modes.","solutions":["Set a restrictive umask before running the agent (e.g. `umask 077` in the shell or service definition) and retry","Check the temp filesystem for forced ACLs or mount masks (`getfacl` on the temp file, mount options) and correct them","Point `TMPDIR` at a filesystem that honors 0600 creation modes and retry","Verify no security software (AV, EDR, ACL daemons) is modifying file modes on creation"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import os, tempfile\nfd, p = tempfile.mkstemp()\nmode = os.stat(p).st_mode & 0o777\nos.close(fd); os.unlink(p)\nassert mode & 0o077 == 0, f\"umask/filesystem yields broad modes: {oct(mode)}\"","typeGuard":null,"tryCatchPattern":"try:\n    artifact = create_temp_artifact(content=content, suffix=\".json\")\nexcept OSError as exc:\n    if \"permissions are too broad\" in str(exc):\n        set_umask_0o077_and_retry()\n    else:\n        raise","preventionTips":["Run agents with umask 077 in services, containers, and CI","Check temp filesystems for forced ACLs or mount masks","Avoid security tooling that widens modes on newly created files","Prefer private per-user temp directories"],"tags":["filesystem","permissions","security","temp-file","umask"],"backgroundTag":"file-permissions-too-broad","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}