{"record":{"id":"8a448a539e74ae5d","repo":"larksuite/cli","slug":"s-path-q-is-world-readable-mode-04o","errorCode":null,"errorMessage":"%s: path %q is world-readable (mode %04o)","messagePattern":"(.+?): path %q is world-readable \\(mode %04o\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/audit_unix.go","lineNumber":53,"sourceCode":"// exec commands typically need for their usual 755 mode).\nfunc auditFilePermissions(effectivePath string, allowReadableByOthers bool, label string) error {\n\tinfo, err := vfs.Stat(effectivePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"%s: cannot stat %q: %w\", label, effectivePath, err)\n\t}\n\tmode := info.Mode().Perm()\n\n\tif mode&0o002 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-writable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif mode&0o020 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is group-writable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif allowReadableByOthers {\n\t\treturn nil\n\t}\n\tif mode&0o004 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is world-readable (mode %04o)\", label, effectivePath, mode)\n\t}\n\tif mode&0o040 != 0 {\n\t\treturn fmt.Errorf(\"%s: path %q is group-readable (mode %04o)\", label, effectivePath, mode)\n\t}\n\treturn nil\n}\n","sourceCodeStart":35,"sourceCodeEnd":60,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/audit_unix.go#L35-L60","documentation":"This error comes from the Unix permission audit performed before binding a credential file. The audit always rejects world/group-writable files and, unless the caller explicitly allows readable-by-others modes (e.g. exec scripts needing 0755), also rejects world-readable files. It fires when the file's permission bits include the other-read bit (0o004), meaning any user on the host can read the (potentially secret) file.","triggerScenarios":"auditFilePermissions(effectivePath, allowReadableByOthers=false, label) stats the file and mode&0o004 != 0 — i.e. the file was created or chmod'ed with a mode like 0644 or 0645 while secrets should be 0600.","commonSituations":"Creating a secret file with os.WriteFile default 0644 instead of 0600; umask too permissive; copying a secret with cp (which preserves default modes); a CLI-run helper script left world-readable.","solutions":["chmod 0600 the reported path (e.g. `chmod 600 ~/.lark-channel/secret`)","Fix the creating code to use os.Chmod / WriteFile mode 0600 (or 0400)","If the file legitimately must be world-readable (an exec helper script), invoke the audit with allowReadableByOthers=true"],"exampleFix":"// before\nos.WriteFile(path, data, 0644)\n// after\nos.WriteFile(path, data, 0600)","handlingStrategy":"validation","validationCode":"info, err := os.Stat(path)\nif err != nil { return err }\nif info.Mode().Perm()&0o004 != 0 {\n    os.Chmod(path, 0600) // tighten before the API call\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create secret files with mode 0600 (or 0400) at write time","Set a restrictive umask (077) in scripts that provision credentials","Audit permission bits after copying or moving secret files"],"tags":["permissions","security","filesystem"],"backgroundTag":"insecure-file-permissions","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}