{"record":{"id":"315f4821938f1747","repo":"ipfs/kubo","slug":"opening-binary-q-w","errorCode":null,"errorMessage":"opening binary %q: %w","messagePattern":"opening binary %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"profile/profile.go","lineNumber":237,"sourceCode":"}\n\nfunc binary(ctx context.Context, _ Options, w io.Writer) error {\n\tvar (\n\t\tpath string\n\t\terr  error\n\t)\n\tif goos == \"linux\" {\n\t\tpid := os.Getpid()\n\t\tpath = fmt.Sprintf(\"/proc/%d/exe\", pid)\n\t} else {\n\t\tpath, err = os.Executable()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"finding binary path: %w\", err)\n\t\t}\n\t}\n\tfi, err := os.Open(path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"opening binary %q: %w\", path, err)\n\t}\n\t_, err = io.Copy(w, fi)\n\t_ = fi.Close()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"copying binary %q: %w\", path, err)\n\t}\n\treturn nil\n}\n\nfunc mutexProfile(ctx context.Context, opts Options, w io.Writer) error {\n\tprev := runtime.SetMutexProfileFraction(opts.MutexProfileFraction)\n\tdefer runtime.SetMutexProfileFraction(prev)\n\terr := waitOrCancel(ctx, opts.ProfileDuration)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn pprof.Lookup(\"mutex\").WriteTo(w, 2)\n}","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/profile/profile.go#L219-L255","documentation":"After resolving the path (via /proc/<pid>/exe on Linux or os.Executable elsewhere), binary() opens the executable with os.Open(path) to copy it into the archive. This error means the resolved binary path exists as a concept but could not be opened for reading, wrapped with the actual path for diagnosis.","triggerScenarios":"os.Open(path) fails: the executable file was deleted after path resolution (dangling path on non-Linux), the process lacks read permission on the binary, /proc/<pid>/exe resolution failed on Linux (e.g. permission checks on deleted binaries), or a security module (SELinux/AppArmor) blocks reading the executable.","commonSituations":"Binaries run with dropped privileges that can no longer read their own image; hardened containers with noexec/no-read policies; deleted-but-running executables on non-Linux systems; SELinux enforcing profiles denying /proc/pid/exe reads.","solutions":["Check the wrapped path and verify it exists and is readable by the process user (ls -l, test -r)","Relax SELinux/AppArmor rules or run the diagnostics collection as a user that can read the binary","Keep the executable file present while the process runs (do not delete-on-upgrade before profiling)","Skip the binary-embedding collector gracefully if unreadable — treat it as optional in your profile set"],"exampleFix":"// before\nerr := WriteProfiles(ctx, p) // fails hard: opening binary \"/app/ipfs\": permission denied\n// after\nif _, serr := os.Stat(binPath); serr == nil {\n    if _, oerr := os.Open(binPath); oerr == nil {\n        err := WriteProfiles(ctx, p)\n    }\n} // or drop the 'binary' collector from the profile list when unreadable","handlingStrategy":"validation","validationCode":"path := binPathFor(runtime.GOOS) // /proc/self/exe or os.Executable()\nif fi, err := os.Open(path); err != nil {\n    log.Printf(\"binary %s unreadable, skip embedding: %v\", path, err)\n} else {\n    fi.Close()\n}","typeGuard":null,"tryCatchPattern":"if err := WriteProfiles(ctx, p); err != nil {\n    var pe *fs.PathError\n    if errors.As(err, &pe) && strings.HasPrefix(err.Error(), \"opening binary\") {\n        log.Printf(\"cannot read binary %s (%v); disable the binary collector\", pe.Path, pe.Err)\n    }\n    return err\n}","preventionTips":["Run diagnostics as a user that can read the executable image","Audit SELinux/AppArmor/container policies for /proc/<pid>/exe reads if profiling on Linux","Keep the binary on disk for the process lifetime; do not delete-on-upgrade","Make binary embedding a skippable step in profile bundles"],"tags":["io","permissions","diagnostics","filesystem"],"backgroundTag":"file-open-permission-denied","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}