{"record":{"id":"3259adb343e88910","repo":"astrid-runtime/astrid","slug":"mountpoint-must-be-owner-private","errorCode":null,"errorMessage":"mountpoint must be owner-private: {}","messagePattern":"mountpoint must be owner-private: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fuse/src/mountpoint.rs","lineNumber":52,"sourceCode":"    }\n    astrid_core::platform_fs::verify_no_redirects(&requested)\n        .with_context(|| format!(\"reject redirected mountpoint {}\", requested.display()))?;\n    let metadata = std::fs::symlink_metadata(&requested)?;\n    if !metadata.is_dir() {\n        bail!(\"mountpoint is not a directory: {}\", requested.display());\n    }\n    let expected_uid = u32::from(getuid());\n    if metadata.uid() != expected_uid {\n        bail!(\n            \"mountpoint must be owned by the current OS user: {}\",\n            requested.display()\n        );\n    }\n    let mode = metadata.permissions().mode();\n    if !existed {\n        std::fs::set_permissions(&requested, Permissions::from_mode(0o700))?;\n    } else if mode & 0o077 != 0 {\n        bail!(\"mountpoint must be owner-private: {}\", requested.display());\n    }\n    if std::fs::read_dir(&requested)?.next().is_some() {\n        bail!(\"mountpoint is not empty: {}\", requested.display());\n    }\n    let canonical = requested\n        .canonicalize()\n        .with_context(|| format!(\"canonicalize mountpoint {}\", requested.display()))?;\n    if mountinfo_contains(&canonical)? {\n        bail!(\"mountpoint is already mounted: {}\", canonical.display());\n    }\n    Ok((canonical, !existed))\n}\n\n/// Return current owner identity for synthetic inode metadata.\npub(crate) fn owner_ids() -> (u32, u32) {\n    (getuid().into(), getgid().into())\n}\n","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fuse/src/mountpoint.rs#L34-L70","documentation":"prepare_mountpoint requires a pre-existing mountpoint directory to be owner-private: its permission mode must have no group or other bits set (mode & 0o077 == 0). Directories created by the function itself get 0o700; anything looser on a pre-existing dir is rejected to keep the mount contents private to the owner.","triggerScenarios":"Passing an existing directory whose mode includes group/other permission bits (e.g. 0o755, 0o775) to prepare_mountpoint instead of letting the library create the directory.","commonSituations":"mkdir -p default umask 022 creating 755 directories; a shared mountpoint directory created by a provisioning script with group access.","solutions":["chmod 700 <mountpoint> before invoking the mount operation","Remove the directory and let prepare_mountpoint create it with 0o700","Update provisioning scripts/templates to create the mountpoint with mode 0700"],"exampleFix":"// before\nmkdir -p /mnt/myfuse   # mode 755\n// after\nmkdir -p /mnt/myfuse && chmod 700 /mnt/myfuse","handlingStrategy":"validation","validationCode":"fn mountpoint_is_owner_private(path: &std::path::Path) -> std::io::Result<bool> {\n    use std::os::unix::fs::PermissionsExt;\n    let md = std::fs::symlink_metadata(path)?;\n    Ok(md.is_dir() && md.permissions().mode() & 0o077 == 0)\n}","typeGuard":"fn is_owner_private(md: &std::fs::Metadata) -> bool {\n    use std::os::unix::fs::PermissionsExt;\n    md.is_dir() && md.permissions().mode() & 0o077 == 0\n}","tryCatchPattern":"match prepare_mountpoint(&path) {\n    Err(e) if e.to_string().contains(\"owner-private\") => {\n        let _ = std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o700));\n        // retry once\n    }\n    other => other?,\n}","preventionTips":["Always chmod 700 pre-existing mountpoint directories","Create mountpoints with umask 077 or explicitly chmod 700 in provisioning scripts","Prefer letting the library create the directory (mode 0o700 enforced automatically)","Audit shared/provisioned mount directories for group/other bits"],"tags":["fuse","filesystem","permissions"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}