{"record":{"id":"8611fcb29c42f365","repo":"astrid-runtime/astrid","slug":"private-path-has-an-extended-access-control-list","errorCode":null,"errorMessage":"private path has an extended access-control list","messagePattern":"private path has an extended access-control list","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/platform_fs.rs","lineNumber":612,"sourceCode":"    let output = std::process::Command::new(\"/bin/ls\")\n        .arg(\"-lde\")\n        .arg(path)\n        .env(\"LC_ALL\", \"C\")\n        .output()?;\n    if !output.status.success() {\n        return Err(io::Error::other(\n            \"failed to inspect extended access-control list\",\n        ));\n    }\n    let listing = String::from_utf8(output.stdout)\n        .map_err(|_| io::Error::other(\"access-control listing is not UTF-8\"))?;\n    let has_acl_entry = listing.lines().skip(1).any(|line| {\n        line.trim_start()\n            .split_once(':')\n            .is_some_and(|(index, _)| index.parse::<usize>().is_ok())\n    });\n    if has_acl_entry {\n        Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"private path has an extended access-control list\",\n        ))\n    } else {\n        Ok(())\n    }\n}\n\n#[cfg(target_os = \"macos\")]\nfn absolute_command_path(path: &Path) -> io::Result<PathBuf> {\n    if path.is_absolute() {\n        Ok(path.to_path_buf())\n    } else {\n        Ok(std::env::current_dir()?.join(path))\n    }\n}\n\n#[cfg(unix)]","sourceCodeStart":594,"sourceCodeEnd":630,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs.rs#L594-L630","documentation":"On macOS, private paths must not carry extended ACL entries beyond the standard POSIX mode bits. validate_no_extended_acl_macos parses `ls -lde` output and throws this when any numbered ACL entry is present, since extra ACL grants can silently widen access even when the mode is 0600.","triggerScenarios":"validate_private_directory or validate_private_file is called on macOS and the target has ACL entries (visible as lines like ` 0: group:everyone deny delete` in `ls -lde`).","commonSituations":"Files restored from backups or Finder copies that carried ACLs; files created under a directory with inherited ACLs; files synced from cloud-drive folders that attach quarantine/ACL entries.","solutions":["Strip ACLs from the file/directory: `chmod -N <path>` (and `chmod -RN <dir>` recursively).","Recreate the file/directory through the library, which runs chmod -N automatically on restrict/ensure paths.","Move the private directory out of a parent folder with inherited ACLs (e.g. ~/Library CloudStorage) to a plain home path.","Inspect with `ls -lde <path>` to confirm no numbered ACL entries remain before retrying."],"exampleFix":"// before (macOS, file has inherited ACL entries)\nvalidate_private_file(Path::new(\"/Users/me/.astrid/credentials\"))?;\n// after\n// $ chmod -N /Users/me/.astrid/credentials\nvalidate_private_file(Path::new(\"/Users/me/.astrid/credentials\"))?;","handlingStrategy":"validation","validationCode":"fn has_no_macos_acl(path: &std::path::Path) -> std::io::Result<bool> {\n    let out = std::process::Command::new(\"/bin/ls\")\n        .args([\"-lde\"]).arg(path).env(\"LC_ALL\", \"C\").output()?;\n    let text = String::from_utf8_lossy(&out.stdout);\n    Ok(!text.lines().skip(1).any(|l| l.trim_start().split_once(':')\n        .is_some_and(|(i, _)| i.parse::<usize>().is_ok())))\n}","typeGuard":null,"tryCatchPattern":"match validate_private_file(path) {\n    Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied\n        && e.to_string().contains(\"access-control list\") => {\n        let _ = std::process::Command::new(\"/bin/chmod\").args([\"-N\"]).arg(path).status()?;\n    },\n    other => other?,\n}","preventionTips":["Run `chmod -N` on files restored from backups or Finder copies","Keep private state out of ACL-inheriting folders (cloud sync dirs)","Check `ls -lde` on macOS when validation fails"],"tags":["macos","filesystem","acl","security"],"backgroundTag":"insufficient-permissions","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}