{"record":{"id":"58896e2d66ec47b4","repo":"projectdiscovery/nuclei","slug":"could-not-create-temp-secrets-file-w","errorCode":null,"errorMessage":"could not create temp secrets file: %w","messagePattern":"could not create temp secrets file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/nuclei/main.go","lineNumber":904,"sourceCode":"\t}\n\n\tif profile.Secrets == nil {\n\t\treturn \"\", nil\n\t}\n\n\tsecretsData, err := yaml.Marshal(profile.Secrets)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not marshal inline secrets: %w\", err)\n\t}\n\n\ttempDir := filepath.Join(os.TempDir(), \"nuclei-secrets\")\n\tif err := os.MkdirAll(tempDir, 0700); err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not create temp directory: %w\", err)\n\t}\n\n\ttempFile, err := os.CreateTemp(tempDir, \"inline-secrets-*.yaml\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"could not create temp secrets file: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = tempFile.Close()\n\t}()\n\n\tif _, err := tempFile.Write(secretsData); err != nil {\n\t\t_ = tempFile.Close()\n\t\t_ = os.Remove(tempFile.Name())\n\t\treturn \"\", fmt.Errorf(\"could not write to temp secrets file: %w\", err)\n\t}\n\n\toptions.SecretsFile = append(options.SecretsFile, tempFile.Name())\n\treturn tempFile.Name(), nil\n}\n","sourceCodeStart":886,"sourceCodeEnd":919,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/cmd/nuclei/main.go#L886-L919","documentation":"os.CreateTemp(tempDir, \"inline-secrets-*.yaml\") failed (cmd/nuclei/main.go:904) while materializing the inline secrets file. The directory was created the line before, so failures here are usually EMFILE (too many open files), permission/MAC denials on the 0700 directory (e.g. owned by another user), or the directory having been removed between creation and use. The wrapped os error carries the errno.","triggerScenarios":"Many concurrent nuclei processes exhausting the fd limit; /tmp/nuclei-secrets created earlier by root while running unprivileged; SELinux/AppArmor denying file creation under /tmp.","commonSituations":"Heavily parallel CI runners; shared servers where different users run nuclei; security-hardened hosts with MAC policies on temp paths.","solutions":["Check and raise the fd limit: `ulimit -n 4096` (or systemd LimitNOFILE)","Fix ownership of the temp dir so the current user can create files inside","Redirect TMPDIR to a private writable directory","Inspect audit/dmesg logs for SELinux/AppArmor denials on /tmp"],"exampleFix":"# before: EMFILE under parallel runs\nnuclei -profile a.yaml & nuclei -profile b.yaml & ...\n\n# after\nulimit -n 4096\nnuclei -profile a.yaml & nuclei -profile b.yaml & ...","handlingStrategy":"try-catch","validationCode":"// pre-flight: can we create files in the temp dir?\nprobe, err := os.CreateTemp(tempDir, \"probe-*\")\nif err != nil { return fmt.Errorf(\"temp dir not creatable: %w\", err) }\n_ = probe.Close()\n_ = os.Remove(probe.Name())","typeGuard":null,"tryCatchPattern":"f, err := os.CreateTemp(tempDir, \"inline-secrets-*.yaml\")\nif err != nil {\n    if errors.Is(err, syscall.EMFILE) {\n        return fmt.Errorf(\"fd limit reached; raise ulimit -n before running parallel scans\")\n    }\n    return fmt.Errorf(\"cannot create temp secrets file in %s: %w\", tempDir, err)\n}","preventionTips":["Raise ulimit -n / LimitNOFILE when running parallel nuclei processes","Ensure the temp dir is owned by the running user","Watch for SELinux/AppArmor denials on hardened hosts"],"tags":["go","nuclei","filesystem","permissions","file-descriptors","concurrency"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}