{"record":{"id":"747af3220782dd3b","repo":"denoland/deno","slug":"temporary-directory-ancestor-is-owned-by-uid","errorCode":null,"errorMessage":"temporary directory ancestor '{}' is owned by uid {}, not current uid {} or root","messagePattern":"temporary directory ancestor '(.+?)' is owned by uid (.+?), not current uid (.+?) or root","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"error","filePath":"cli/util/temp.rs","lineNumber":131,"sourceCode":"  }\n  ensure_secure_temp_dir(path)\n}\n\n#[cfg(unix)]\nfn ensure_secure_temp_parent(path: &Path) -> Result<(), AnyError> {\n  use std::os::unix::fs::MetadataExt;\n  use std::os::unix::fs::OpenOptionsExt;\n\n  // SAFETY: geteuid has no preconditions.\n  let current_uid = unsafe { libc::geteuid() };\n  for ancestor in path.ancestors() {\n    let dir = std::fs::OpenOptions::new()\n      .read(true)\n      .custom_flags(libc::O_NOFOLLOW | libc::O_DIRECTORY)\n      .open(ancestor)?;\n    let metadata = dir.metadata()?;\n    if metadata.uid() != current_uid && metadata.uid() != 0 {\n      bail!(\n        \"temporary directory ancestor '{}' is owned by uid {}, not current uid {} or root\",\n        ancestor.display(),\n        metadata.uid(),\n        current_uid\n      );\n    }\n    let mode = metadata.mode();\n    if mode & 0o022 != 0 && mode & 0o1000 == 0 {\n      bail!(\n        \"temporary directory ancestor '{}' is writable by other users without the sticky bit\",\n        ancestor.display()\n      );\n    }\n  }\n  Ok(())\n}\n\n#[cfg(not(unix))]","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/util/temp.rs#L113-L149","documentation":"Before creating its temp node_modules root (`<tmp>/deno_nm`), Deno canonicalizes the temp dir and walks every ancestor, opening each with O_NOFOLLOW|O_DIRECTORY (`ensure_secure_temp_parent`, cli/util/temp.rs). If any ancestor's owner uid is neither the current effective uid nor root (0), Deno refuses to proceed — a directory another user controls could be swapped or manipulated underneath Deno's temp files.","triggerScenarios":"TMPDIR/TMP pointing under a directory owned by a different non-root user: `TMPDIR=/home/otheruser/tmp` while running as your uid, a shared volume like /mnt/data/tmp chowned to a service account, or NFS mounts with uid mapping showing foreign ownership. Hit on the first `deno install`/run that needs the temp node_modules dir.","commonSituations":"Containers with TMPDIR set to an app-owned path; NFS/network mounts with idmapping; multi-user servers sharing scratch directories; sudo/user transition flows where the effective uid differs from the directory owner.","solutions":["Point TMPDIR at a directory you own: `mkdir -p ~/tmp && export TMPDIR=~/tmp`.","Or unset TMPDIR and use the system /tmp, which is root-owned with the sticky bit and passes the walk.","If sharing is intended, have the admin `chown` the ancestor to your user (or a common uid).","Avoid TMPDIRs under other users' home directories or foreign-uid volumes."],"exampleFix":"# before\nexport TMPDIR=/srv/shared/tmp   # owned by uid 1000, you are uid 1001\ndeno install\n# error: temporary directory ancestor '/srv/shared/tmp' is owned by uid 1000, not current uid 1001\n\n# after\nmkdir -p \"$HOME/tmp\" && export TMPDIR=\"$HOME/tmp\"\ndeno install","handlingStrategy":"validation","validationCode":"# pre-check every TMPDIR ancestor for foreign non-root ownership\nd=\"$(cd \"${TMPDIR:-/tmp}\" && pwd -P)\"; uid=\"$(id -u)\"\nwhile [ \"$d\" != \"/\" ]; do\n  o=\"$(stat -c %u \"$d\" 2>/dev/null || echo 0)\"\n  if [ \"$o\" != \"$uid\" ] && [ \"$o\" != \"0\" ]; then\n    echo \"insecure temp ancestor: $d (uid $o)\"\n  fi\n  d=\"$(dirname \"$d\")\"\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default to the system /tmp or a per-user TMPDIR under your own home.","Never set TMPDIR under another user's home or a foreign-uid shared volume.","In containers, give each uid its own temp path instead of sharing one."],"tags":["security","temp-dir","permissions","unix","ownership"],"backgroundTag":"insecure-temp-directory","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}