{"record":{"id":"2ed68a0c6dc95f7a","repo":"paperclipai/paperclip","slug":"runner-diagnostics-directory-is-accessible-by-grou","errorCode":null,"errorMessage":"runner diagnostics directory is accessible by group or other users","messagePattern":"runner diagnostics directory is accessible by group or other users","errorType":"error_code","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs","lineNumber":57,"sourceCode":"        .take_while(|index| *index <= byte_limit)\n        .last()\n        .unwrap_or(0);\n    diagnostic.truncate(boundary);\n    diagnostic.push_str(suffix);\n    diagnostic\n}\n\nfn verify_private_diagnostics_directory(directory: &Path) -> io::Result<()> {\n    let metadata = fs::symlink_metadata(directory)?;\n    if metadata.file_type().is_symlink() || !metadata.is_dir() {\n        return Err(io::Error::new(\n            io::ErrorKind::InvalidInput,\n            \"runner diagnostics path is not a real directory\",\n        ));\n    }\n    #[cfg(unix)]\n    if metadata.permissions().mode() & 0o077 != 0 {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"runner diagnostics directory is accessible by group or other users\",\n        ));\n    }\n    Ok(())\n}\n\nfn persist_runner_diagnostic(directory: &Path, message: &str) -> io::Result<()> {\n    verify_private_diagnostics_directory(directory)?;\n    let destination = directory.join(\"runnerd.stderr.log\");\n    let contents = bounded_redacted_diagnostic(message);\n    let process_id = std::process::id();\n    for attempt in 0..RUNNER_DIAGNOSTIC_TEMP_ATTEMPTS {\n        let temporary = directory.join(format!(\".runnerd.stderr.log.{process_id}.{attempt}.tmp\"));\n        let mut options = OpenOptions::new();\n        options.write(true).create_new(true);\n        #[cfg(unix)]\n        options.mode(0o600);","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs#L39-L75","documentation":"Guard in verify_private_diagnostics_directory (unix branch): the diagnostics directory's permission mode has group or other bits set (mode & 0o077 != 0). Runner diagnostics can contain sensitive run data, so the directory must be owner-private; the error fires when the directory is readable or writable by group/other users.","triggerScenarios":"Thrown at packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs:57 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run `chmod 700 <diagnostics-dir>` to strip group/other permissions","Ensure umask or provisioning tooling is not creating the directory with permissive modes","Restart paperclip-runnerd after fixing the mode"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}