{"record":{"id":"6ac346961544f4fc","repo":"juicedata/juicefs","slug":"write-s-to-s","errorCode":null,"errorMessage":"write %s to %s","messagePattern":"write (.+?) to (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/fuse/device_linux.go","lineNumber":111,"sourceCode":"\t\t}\n\n\t\tif (parts[0] == \"c\" || parts[0] == \"a\") && (parts[1] == \"10:229\" || parts[1] == \"*:*\") && parts[2] == \"rwm\" {\n\t\t\tlogger.Debug(\"/dev/fuse is already granted\")\n\t\t\t// fuse is already allowed\n\t\t\treturn nil\n\t\t}\n\t}\n\n\tf, err := os.OpenFile(deviceAllowPath, os.O_WRONLY, 0)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"open %s\", deviceAllowPath)\n\t}\n\tdefer f.Close()\n\t// 10, 229 according to https://www.kernel.org/doc/Documentation/admin-guide/devices.txt\n\tcontent := \"c 10:229 rwm\"\n\t_, err = f.WriteString(content)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"write %s to %s\", content, deviceAllowPath)\n\t}\n\tlogger.Debug(\"/dev/fuse is granted\")\n\treturn nil\n}\n","sourceCodeStart":93,"sourceCodeEnd":116,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/fuse/device_linux.go#L93-L116","documentation":"Wraps the failure of writing 'c 10:229 rwm' (the /dev/fuse device rule) into the cgroup v1 devices.allow file in grantAccess. Without a successful write the container is not permitted to use the FUSE device, and the wrapped error shows why (read-only cgroup or permissions).","triggerScenarios":"f.WriteString fails on devices.allow — typically EPERM/EACCES (process lacks rights even though the file opened), ENOENT if the cgroup was torn down between open and write, or EINVAL from a kernel rejecting the value.","commonSituations":"Containers where devices.allow opens but writes are denied by LSMs (AppArmor/SELinux); race with container teardown; restricted seccomp profiles blocking cgroup writes.","solutions":["Run as root with SYS_ADMIN and no restrictive LSM profile blocking cgroup writes","In Docker, use --privileged or add --device /dev/fuse so the write is unnecessary","Grant the device on the host instead (host-level udev rule or echo into the host cgroup)","Retry if a race with container startup/teardown caused ENOENT"],"exampleFix":"// before (AppArmor-restricted container)\ndocker run juicefs mount ...   // write c 10:229 rwm to ...devices.allow: operation not permitted\n// after\ndocker run --privileged --device /dev/fuse juicefs mount ...","handlingStrategy":"try-catch","validationCode":"// check LSM/capabilities before attempting the write\nif !hasCapSysAdmin() { // e.g. via capability package\n  // write to devices.allow will be denied\n}","typeGuard":null,"tryCatchPattern":"if err := grantAccess(); err != nil && strings.Contains(err.Error(), \"write c 10:229 rwm\") {\n  return fmt.Errorf(\"kernel denied devices.allow write (LSM/capabilities); grant /dev/fuse on the host: %w\", err)\n}","preventionTips":["Run with --privileged or a permissive AppArmor/SELinux profile in containers","Grant the device on the host (udev rule) rather than inside restricted containers","Avoid racy container startup/teardown around mount time"],"tags":["linux","cgroups","permissions","fuse"],"backgroundTag":"file-write-failed","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}