{"record":{"id":"820c089ec4081b83","repo":"unslothai/unsloth","slug":"system-directories-are-not-allowed","errorCode":null,"errorMessage":"System directories are not allowed","messagePattern":"System directories are not allowed","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"warning","filePath":"studio/backend/core/rag/folder_sync.py","lineNumber":161,"sourceCode":"        is_denied_system_path,\n    )\n    from utils.paths.external_media import is_local_filesystem_root\n\n    if not os.path.isdir(normalized):\n        raise ValueError(\"Path must be a directory, not a file\")\n    if not os.access(normalized, os.R_OK | os.X_OK):\n        raise ValueError(\"Path is not readable\")\n    if is_local_filesystem_root(normalized):\n        raise ValueError(\"The filesystem root cannot be registered\")\n    try:\n        if Path(normalized) == Path.home().resolve():\n            raise ValueError(\"The entire home folder cannot be registered\")\n    except RuntimeError:\n        pass\n    if contains_sensitive_path_component(normalized):\n        raise ValueError(\"Credential or configuration directories are not allowed\")\n    if is_denied_system_path(normalized):\n        raise ValueError(\"System directories are not allowed\")\n    return normalized\n\n\ndef _root_identity(root: str) -> tuple[int, int]:\n    try:\n        root_stat = os.lstat(root)\n    except OSError as exc:\n        raise RuntimeError(\"Linked folder is unavailable\") from exc\n    if stat.S_ISLNK(root_stat.st_mode) or not stat.S_ISDIR(root_stat.st_mode):\n        raise RuntimeError(\"Linked folder is no longer a regular directory\")\n    if os.path.normcase(os.path.realpath(root)) != os.path.normcase(root):\n        raise RuntimeError(\"Linked folder no longer resolves to its registered path\")\n    return root_stat.st_dev, root_stat.st_ino\n\n\ndef _store_identity(identity: tuple[int, int]) -> tuple[int | str, int | str]:\n    return tuple(value if value <= _SQLITE_INTEGER_MAX else f\"x{value:x}\" for value in identity)\n","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/core/rag/folder_sync.py#L143-L179","documentation":"ValueError raised when is_denied_system_path(normalized) classifies the path as a system directory (e.g. /usr, /bin, /etc, /Windows, /System32, Program Files). These trees contain OS binaries and machine-critical data; scanning them is slow, pointless for RAG, and can touch executable/system state, so they are denied after the sensitive-component check as the last policy gate before the path is accepted.","triggerScenarios":"Registering /usr/share/docs, /etc, C:\\\\Windows, or a Program Files application folder; paths that realpath resolves into a system tree via a bind mount or junction.","commonSituations":"Users trying to index software documentation shipped under /usr/share; Windows users selecting Program Files; containers where the app folder is under /usr/lib.","solutions":["Copy the specific documentation files you need into a user folder and register that.","Choose a user-writable location (~/Documents, /srv/data, D:\\\\Docs) for scanned content.","Check is_denied_system_path's deny list in hub.storage.scan_folders to see exactly which roots are blocked."],"exampleFix":"# before\nvalidate_folder_path('/usr/share/doc')\n\n# after\n# copy desired docs out of system tree first\nvalidate_folder_path('/home/me/Documents/system-docs')","handlingStrategy":"validation","validationCode":"from hub.storage.scan_folders import is_denied_system_path\nimport os\n\ndef folder_is_not_system_path(path: str) -> bool:\n    normalized = os.path.realpath(os.path.abspath(os.path.expanduser(path)))\n    return not is_denied_system_path(normalized)","typeGuard":null,"tryCatchPattern":"try:\n    validate_folder_path(path)\nexcept ValueError as e:\n    if \"System directories\" not in str(e):\n        raise\n    return bad_request(\"system directories cannot be indexed; copy docs to a user folder\")","preventionTips":["Keep indexed content under user-writable locations (~/Documents, /srv/data, D:\\\\Docs).","Copy vendor documentation out of /usr/share or Program Files before registering.","Consult the deny list in hub.storage.scan_folders when onboarding unusual OS layouts."],"tags":["paths","system-directories","validation","security"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}