{"record":{"id":"214544a7b618a409","repo":"zeroclaw-labs/zeroclaw","slug":"failed-to-set-restrictive-acl-via-icacls-key-file","errorCode":null,"errorMessage":"Failed to set restrictive ACL via icacls; key file permissions may be insecure","messagePattern":"Failed to set restrictive ACL via icacls; key file permissions may be insecure","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-config/src/secrets.rs","lineNumber":897,"sourceCode":"    }\n\n    match std::process::Command::new(\"icacls\")\n        .arg(path)\n        .args([\"/inheritance:r\", \"/grant:r\"])\n        .arg(grant_arg)\n        .output()\n    {\n        Ok(o) if !o.status.success() => {\n            ::zeroclaw_log::record!(\n                WARN,\n                ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Note)\n                    .with_outcome(::zeroclaw_log::EventOutcome::Unknown),\n                &format!(\n                    \"Failed to set key file permissions via icacls (exit code {:?})\",\n                    o.status.code()\n                )\n            );\n            anyhow::bail!(\n                \"Failed to set restrictive ACL via icacls; \\\n                 key file permissions may be insecure\"\n            );\n        }\n        Err(e) => {\n            ::zeroclaw_log::record!(\n                WARN,\n                ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Note)\n                    .with_outcome(::zeroclaw_log::EventOutcome::Unknown)\n                    .with_attrs(::serde_json::json!({\"error\": format!(\"{}\", e)})),\n                \"Could not set key file permissions\"\n            );\n            anyhow::bail!(\n                \"Could not set key file permissions via icacls; \\\n                 key file permissions may be insecure\"\n            );\n        }\n        _ => {}","sourceCodeStart":879,"sourceCodeEnd":915,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-config/src/secrets.rs#L879-L915","documentation":"After ownership, apply_windows_acl runs `icacls <path> /inheritance:r /grant:r <user>...` to strip inherited ACEs and grant only the current user. This error is the Ok-but-non-zero arm: icacls ran and refused, so the restrictive ACL was not established. Per the fail-closed contract, key publication aborts (temp file is removed) rather than leaving a key readable with inherited directory permissions. The WARN log above records icacls' exit code.","triggerScenarios":"icacls rejects the grant argument (username with unusual characters that build_windows_icacls_grant_arg escaped into an invalid ACE string); applying to a file on a filesystem without ACL support (FAT32 USB, some network shares → icacls \"not supported\"); group policy/ownership mismatch denying the DACL write; SID resolution failure for the user.","commonSituations":"ZeroClaw data on a FAT/exFAT drive or SMB share where NTFS ACLs do not apply; usernames with domain prefixes or special characters; the earlier takeown succeeded partially so the DACL write is denied.","solutions":["Run `icacls <keydir>\\<file> /inheritance:r /grant:r \"%USERNAME%:F\"` manually to see icacls' native error message","Move the key directory to a local NTFS volume with standard ACL support","If the username is unusual, provision under an account with a simple name, or pre-create the key file manually with correct ACLs so ZeroClaw only reads it"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"match provision_key(&path) {\n    Err(e) if e.to_string().contains(\"Failed to set restrictive ACL via icacls\") => {\n        eprintln!(\"run manually to see the native error: icacls {} /inheritance:r /grant:r \\\"%USERNAME%:F\\\"\", path.display());\n        eprintln!(\"if the volume lacks ACL support (FAT/network), move the key dir to local NTFS\");\n    }\n    other => other?,\n}","preventionTips":["Store key material only on NTFS volumes with standard ACL support","Pre-hardening: create the key file yourself with a correct ACL, then point ZeroClaw at the existing key"],"tags":["windows","acl","icacls","secrets","key-management","permissions"],"backgroundTag":"file-permission-denied","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}