{"record":{"id":"4d7aac797ea444be","repo":"larksuite/cli","slug":"s-path-q-is-owned-by-uid-d-expected-d","errorCode":null,"errorMessage":"%s: path %q is owned by uid %d, expected %d","messagePattern":"(.+?): path %q is owned by uid (.+?), expected (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/audit_unix.go","lineNumber":27,"sourceCode":"\t\"fmt\"\n\t\"os\"\n\t\"syscall\"\n\n\t\"github.com/larksuite/cli/internal/vfs\"\n)\n\n// checkOwnerUID verifies the file is owned by the current user.\nfunc checkOwnerUID(path, label string) error {\n\tstat, err := vfs.Stat(path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: cannot stat %q: %w\", label, path, err)\n\t}\n\tsysStat, ok := stat.Sys().(*syscall.Stat_t)\n\tif !ok {\n\t\treturn fmt.Errorf(\"%s: cannot retrieve file owner for %q\", label, path)\n\t}\n\tif sysStat.Uid != uint32(os.Getuid()) {\n\t\treturn fmt.Errorf(\"%s: path %q is owned by uid %d, expected %d\",\n\t\t\tlabel, path, sysStat.Uid, os.Getuid())\n\t}\n\treturn nil\n}\n\n// auditFilePermissions rejects world/group-writable modes (always) and\n// world/group-readable modes (unless allowReadableByOthers is true, which\n// exec commands typically need for their usual 755 mode).\nfunc auditFilePermissions(effectivePath string, allowReadableByOthers bool, label string) error {\n\tinfo, err := vfs.Stat(effectivePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: cannot stat %q: %w\", label, effectivePath, err)\n\t}\n\tmode := info.Mode().Perm()\n\n\tif mode&0o002 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-writable (mode %04o)\", label, effectivePath, mode)\n\t}","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/audit_unix.go#L9-L45","documentation":"The security audit requires that the audited file is owned by the user running lark-cli. If the file's UID (read from syscall.Stat_t) differs from os.Getuid(), checkOwnerUID throws this error so a file controlled by another account (root, another team member, a service user) cannot be bound into secrets or command resolution — another owner could silently replace its contents.","triggerScenarios":"AssertSecurePath (without AllowInsecurePath) audits a file whose owner UID != current uid: file installed by root (e.g. system-wide install with root ownership), files copied from a tarball preserving another uid, or shared workstations where a colleague created the file.","commonSituations":"Script deployed by puppet/ansible as root but executed by a normal user; scp/tar transfers preserving uid 0; files created inside containers as root and used from a bind mount by a non-root host user; NFS with uid mapping mismatch (squash_all / anonuid).","solutions":["chown the file to your user: sudo chown $(id -u):$(id -g) <path> (if policy allows)","Copy the file so you become the owner: cp <path> ~/bin/tool && chmod 700 ~/bin/tool, then point config at your copy","Re-install the tool into your user space so files are created with your uid","If the other-owner file is intentional, use the option that sets AllowInsecurePath — accepting the risk explicitly","Fix NFS uid mapping (root_squash/anonuid settings) if the mismatch comes from the mount"],"exampleFix":"// before\n-rwxr--r-- root root /opt/tool/bin/agent.sh   # owned by root, run as alice\n// after\nsudo chown alice:alice /opt/tool/bin/agent.sh  # or cp to ~/bin and chown there","handlingStrategy":"validation","validationCode":"if st, err := os.Stat(path); err == nil {\n  if sys, ok := st.Sys().(*syscall.Stat_t); ok && int(sys.Uid) != os.Getuid() {\n    return fmt.Errorf(\"%s owned by uid %d, run as %d\", path, sys.Uid, os.Getuid())\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["chown audited files to the user running the CLI","Install personal tools into user space, not root-owned system paths","Fix uid mapping on NFS mounts; avoid root-created bind-mount files","Re-check ownership after provisioning/CI jobs that create files as root"],"tags":["security-audit","file-ownership","permissions","unix"],"backgroundTag":"file-owned-by-other-user","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}