{"record":{"id":"81bf1662d63a14ab","repo":"larksuite/cli","slug":"s-path-q-is-group-writable-mode-04o","errorCode":null,"errorMessage":"%s: path %q is group-writable (mode %04o)","messagePattern":"(.+?): path %q is group-writable \\(mode %04o\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/binding/audit_unix.go","lineNumber":47,"sourceCode":"\t}\n\treturn nil\n}\n\n// auditFilePermissions rejects world/group-writable modes (always) and\n// world/group-readable modes (unless allowReadableByOthers is true, which\n// exec commands typically need for their usual 755 mode).\nfunc auditFilePermissions(effectivePath string, allowReadableByOthers bool, label string) error {\n\tinfo, err := vfs.Stat(effectivePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: cannot stat %q: %w\", label, effectivePath, err)\n\t}\n\tmode := info.Mode().Perm()\n\n\tif mode&0o002 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-writable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif mode&0o020 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is group-writable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif allowReadableByOthers {\n\t\treturn nil\n\t}\n\tif mode&0o004 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-readable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif mode&0o040 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is group-readable (mode %04o)\", label, effectivePath, mode)\n\t}\n\treturn nil\n}\n","sourceCodeStart":29,"sourceCodeEnd":60,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/audit_unix.go#L29-L60","documentation":"The permission audit rejects group-writable files (mode & 0o020 != 0). Anyone in the file's group could modify a file used for secret or command resolution, so group-write is disallowed whenever the audit runs — AllowReadableByOthers only relaxes read checks, never write checks. This failure means the file's group has more access than the security model permits.","triggerScenarios":"AssertSecurePath audits a file whose permission bits include g+w (e.g. mode 0775, 0664) and the audit is active (AllowInsecurePath false). Group membership changes on shared hosts make this appear after a previously-clean file is re-audited.","commonSituations":"Default umask 002 on developer workstations (common on some Linux distros) producing 664/775 files; files edited via a shared group checkout; ACL/setup scripts that chmod 775 everything.","solutions":["chmod g-w <path> — typically chmod 755 (executables) or 600 (private files), then re-run","Set umask 022 before creating files intended for the audit","Remove the user from the shared group if group sharing is no longer needed (affects new files)","Recreate the file under a personal group (chown user:user) so group-write semantics are under your control"],"exampleFix":"// before\n-rwxrwxr-x deploy.sh   # group-writable\n// after\nchmod 755 deploy.sh\n-rwxr-xr-x deploy.sh","handlingStrategy":"validation","validationCode":"func groupWritable(p string) (bool, error) {\n  fi, err := os.Stat(p)\n  if err != nil { return false, err }\n  return fi.Mode().Perm()&0o020 != 0, nil\n}\n// fix before calling: if w, _ := groupWritable(p); w { os.Chmod(p, 0o755) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set umask 022 so new files are not group-writable","chmod g-w files from shared group checkouts before registering them","Recheck permissions after membership or provisioning changes on shared hosts"],"tags":["security-audit","permissions","group-writable","unix"],"backgroundTag":"group-writable-file","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}