{"record":{"id":"92184f9f3a8ff1bc","repo":"kubernetes/kops","slug":"error-during-chmod-of-q-w","errorCode":null,"errorMessage":"error during chmod of %q: %w","messagePattern":"error during chmod of %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/sshfs.go","lineNumber":227,"sourceCode":"\t\t}\n\t}()\n\tif _, err := io.Copy(f, data); err != nil {\n\t\treturn fmt.Errorf(\"writing to sftp temp file: %w\", err)\n\t}\n\n\tshouldClose = false\n\tif err := f.Close(); err != nil {\n\t\treturn err\n\t}\n\n\tif acl != nil {\n\t\tsshACL, ok := acl.(*SSHAcl)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"unexpected acl type %T\", acl)\n\t\t} else {\n\t\t\terr = sftpClient.Chmod(tempfile, sshACL.Mode)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error during chmod of %q: %w\", tempfile, err)\n\t\t\t}\n\t\t}\n\t}\n\n\t// posix rename will replace the destination (normal sftp rename does not)\n\tusePosixRename := true\n\tif usePosixRename {\n\t\t// posix rename fails if destination exists, try to delete just in case\n\t\tif err := sftpClient.Remove(p.path); err != nil {\n\t\t\tif os.IsNotExist(err) {\n\t\t\t\t// expected when file does not exist already\n\t\t\t} else {\n\t\t\t\treturn fmt.Errorf(\"removing destination sftp file %q before rename: %w\", p.path, err)\n\t\t\t}\n\t\t}\n\t\tif err := sftpClient.Rename(tempfile, p.path); err != nil {\n\t\t\treturn fmt.Errorf(\"renaming sftp file %q -> %q (with posix rename): %w\", tempfile, p.path, err)\n\t\t}","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/sshfs.go#L209-L245","documentation":"After writing the temp file, WriteFile applies the *SSHAcl Mode via sftpClient.Chmod. If the chmod fails on the SFTP server, the error is wrapped with this message naming the temp file path. This ensures the final renamed file has the intended permissions (e.g. 0600 for secrets).","triggerScenarios":"sftpClient.Chmod(tempfile, sshACL.Mode) returns an error: the SFTP user owns the file but the server rejects chmod (chroot/subsystem restrictions), or the connection dropped between Create and Chmod.","commonSituations":"SFTP servers configured with a fixed umask or denying CHMOD requests; restrictive sshd Subsystem configs on bastions; permission enforcement (e.g. restricted SFTP user) on managed hosts.","solutions":["SSH to the host and set the mode manually, then retry the overall operation: `chmod <mode> <dir>/.tmp-*` or fix the server config.","Check sshd_config / SFTP subsystem configuration (internal-sftp with -u umask) and allow CHMOD or set the desired umask.","If the ACL mode is not essential, pass acl=nil to skip the chmod step.","Retry if the wrapped error is transient (connection reset)."],"exampleFix":"// before: sshd denies chmod for restricted sftp user\nSubsystem sftp internal-sftp -u 077 -d /srv\n// after: allow ownership-preserving perms\nSubsystem sftp internal-sftp -u 022 -d /srv","handlingStrategy":"fallback","validationCode":"// confirm the SFTP user can chmod in the target dir\nout := sshRun(host, fmt.Sprintf(\"touch %s/.permtest && chmod 600 %s/.permtest && rm %s/.permtest && echo chmod-ok\", dir, dir, dir))","typeGuard":null,"tryCatchPattern":"err := path.WriteFile(ctx, data, acl)\nif err != nil && strings.Contains(err.Error(), \"error during chmod\") {\n    // fall back: fix remote perms out-of-band, or retry with nil acl\n    sshRun(host, fmt.Sprintf(\"chmod %o %s/.tmp-*\", 0o600, dir))\n    return path.WriteFile(ctx, data, nil)\n}","preventionTips":["Configure sshd internal-sftp with a umask that already yields the desired modes (-u 022).","Avoid restricted SFTP accounts that block the CHMOD request.","Only pass an ACL when the mode is actually required."],"tags":["ssh","sftp","permissions","chmod"],"backgroundTag":"sftp-chmod-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}