{"record":{"id":"38e94e67b9e587ec","repo":"larksuite/cli","slug":"s-path-q-is-group-readable-mode-04o","errorCode":null,"errorMessage":"%s: path %q is group-readable (mode %04o)","messagePattern":"(.+?): path %q is group-readable \\(mode %04o\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/audit_unix.go","lineNumber":56,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: cannot stat %q: %w\", label, effectivePath, err)\n\t}\n\tmode := info.Mode().Perm()\n\n\tif mode&0o002 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-writable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif mode&0o020 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is group-writable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif allowReadableByOthers {\n\t\treturn nil\n\t}\n\tif mode&0o004 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-readable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif mode&0o040 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is group-readable (mode %04o)\", label, effectivePath, mode)\n\t}\n\treturn nil\n}\n","sourceCodeStart":38,"sourceCodeEnd":60,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/audit_unix.go#L38-L60","documentation":"Same Unix permission audit family: this variant fires when the file is group-readable (mode&0o040 set). The library rejects group-readable secret files because any user in the file's group could read credentials. It is only checked when allowReadableByOthers is false.","triggerScenarios":"auditFilePermissions with allowReadableByOthers=false and the stat'ed mode has the group-read bit set, e.g. 0640, 0660, 0750.","commonSituations":"Secret file assigned to a shared group by default group policy; `chown`/`chgrp` workflows; restrictive-umask setups that still add group read (umask 027 leaves g+r).","solutions":["chmod 0600 the reported path","Remove the group-read bit: `chmod g-r <path>`","Change the owning group or move the file out of a shared-group directory","Use allowReadableByOthers=true only if the caller genuinely permits group access"],"exampleFix":"// before\n-rw-r-----  secret  (0640)\n// after\nchmod 600 secret   # -rw-------  (0600)","handlingStrategy":"validation","validationCode":"info, err := os.Stat(path)\nif err != nil { return err }\nif info.Mode().Perm()&0o040 != 0 {\n    os.Chmod(path, 0600) // drop group-read before binding\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never chgrp secret files to shared groups","Use umask 077 so group bits are never granted by default","Include permission checks in provisioning/CI scripts"],"tags":["permissions","security","filesystem"],"backgroundTag":"insecure-file-permissions","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}