{"record":{"id":"3460cb0cf31619d4","repo":"chenhg5/cc-connect","slug":"project-q-audit-s","errorCode":null,"errorMessage":"project %q audit: %s","messagePattern":"project %q audit: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cc-connect/runas_startup.go","lineNumber":150,"sourceCode":"\t\tif o.preflight.HasFatal() {\n\t\t\tcontinue\n\t\t}\n\t\tif o.auditErr != nil {\n\t\t\tslog.Error(\"run_as_user: isolation probe failed to run\",\n\t\t\t\t\"project\", o.project, \"error\", o.auditErr)\n\t\t\tfatals = append(fatals, fmt.Errorf(\"project %q probe: %w\", o.project, o.auditErr))\n\t\t\tcontinue\n\t\t}\n\t\tslog.Info(\"run_as_user: isolation audit completed\",\n\t\t\t\"project\", o.project,\n\t\t\t\"whoami\", o.audit.Identity.Whoami,\n\t\t\t\"workdir_writable\", o.audit.WorkDirStatus.Writable,\n\t\t\t\"target_paths\", len(o.audit.TargetPaths),\n\t\t\t\"cross_user_results\", len(o.audit.CrossUser),\n\t\t)\n\t\tfor _, f := range o.audit.Fatal {\n\t\t\tslog.Error(\"run_as_user: audit FATAL\", \"project\", o.project, \"error\", f)\n\t\t\tfatals = append(fatals, fmt.Errorf(\"project %q audit: %s\", o.project, f))\n\t\t}\n\t}\n\n\tif len(fatals) > 0 {\n\t\treturn fmt.Errorf(\"run_as_user startup checks failed for %d project(s); see logs above\", len(fatals))\n\t}\n\treturn nil\n}\n","sourceCodeStart":132,"sourceCodeEnd":159,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/cmd/cc-connect/runas_startup.go#L132-L159","documentation":"After a successful isolation probe, runRunAsUserStartupChecks iterates o.audit.Fatal findings and wraps each as `project %q audit: %s`. These are isolation violations discovered by the probe (cross-user access to sensitive paths, unexpected identity, etc.).","triggerScenarios":"The isolation audit ran and found fatal findings: e.g. cross_user results showing the run-as user can read/write target paths it shouldn't, or workdir writable check reveals unsafe permissions.","commonSituations":"Target paths world-writable or group-shared with the run-as user; run-as user accidentally in the same group as the primary user; over-broad ACLs after copying configs.","solutions":["Locate the 'run_as_user: audit FATAL' log lines listing each specific finding.","Restrict the offending target paths (chmod/chown so the run-as user cannot access them).","If a path is intentionally shared, move it out of the audited target set or adjust project configuration; re-run to confirm clean."],"exampleFix":"// before\nchmod 777 /home/user/data\n// after\nchown user:user /home/user/data && chmod 750 /home/user/data","handlingStrategy":"validation","validationCode":"# ensure run-as user cannot reach sensitive targets\nfor p in \"$TARGET_PATHS\"; do sudo -u \"$RUNAS_USER\" test -r \"$p\" && echo \"VIOLATION: readable $p\"; done","typeGuard":null,"tryCatchPattern":"if err := runRunAsUserStartupChecks(ctx); err != nil {\n    if strings.Contains(err.Error(), \"audit:\") {\n        slog.Error(\"isolation audit found violations; tighten target path permissions\")\n    }\n    return err\n}","preventionTips":["Default to 750/640 permissions on sensitive target paths.","Never place the run-as user in the primary user's group.","Re-run the audit after granting any new ACLs or group memberships."],"tags":["go","startup","security","isolation-audit"],"backgroundTag":"permission-denied","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}