{"record":{"id":"a79ff7fb76759e3b","repo":"wasmerio/wasmer","slug":"is-world-writable-and-not-sticky-m","errorCode":null,"errorMessage":"{} is world writable and not sticky ({m:?})","messagePattern":"(.+?) is world writable and not sticky \\((.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/cli/src/commands/binfmt.rs","lineNumber":55,"sourceCode":"    #[clap(subcommand)]\n    action: Action,\n}\n\n// Quick safety check:\n// This folder isn't world writable (or else its sticky bit is set), and neither are its parents.\n//\n// If somebody mounted /tmp wrong, this might result in a TOCTOU problem.\nfn seccheck(path: &Path) -> Result<()> {\n    if let Some(parent) = path.parent() {\n        seccheck(parent)?;\n    }\n    let m = std::fs::metadata(path)\n        .with_context(|| format!(\"Can't check permissions of {}\", path.to_string_lossy()))?;\n    use unix_mode::*;\n    anyhow::ensure!(\n        !is_allowed(Accessor::Other, Access::Write, m.mode()) || is_sticky(m.mode()),\n        \"{} is world writable and not sticky ({m:?})\",\n        path.to_string_lossy()\n    );\n    Ok(())\n}\n\nimpl Binfmt {\n    /// The filename used to register the wasmer CLI as a binfmt interpreter.\n    pub const FILENAME: &'static str = \"wasmer-binfmt-interpreter\";\n\n    /// execute [Binfmt]\n    pub fn execute(&self) -> Result<()> {\n        if !self.binfmt_misc.exists() {\n            bail!(\"{} does not exist\", self.binfmt_misc.to_string_lossy());\n        }\n        let temp_dir;\n        let specs = match self.action {\n            Register | Reregister => {\n                temp_dir = tempfile::Builder::new()\n                    .permissions(Permissions::from_mode(0o1755))","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/wasmerio/wasmer/blob/8c4b9ee9d33fb2068863fbb3d328683e7e6ff7f5/lib/cli/src/commands/binfmt.rs#L37-L73","documentation":"As part of `seccheck` for the `binfmt register` flow, wasmer refuses to register an interpreter whose path (or a parent) is world-writable and lacks the sticky bit, because a local attacker could replace the binary and gain execution via binfmt. `anyhow::ensure!` raises this error when `is_allowed(Other, Write, mode)` is true and `is_sticky(mode)` is false.","triggerScenarios":"Running `wasmer binfmt register` where the wasmer binary or any of its parent directories has mode bits allowing 'other' write (e.g. 0777, 0775-with-other-write) without the sticky bit (no 01000 bit).","commonSituations":"wasmer installed under /home/user with a home directory of 0777; a shared/tmp-like install directory (e.g. /usr/local/share mounted 1777-without-sticky, or 0777); permissive umask misconfiguration; multi-user servers where admins hardened nothing.","solutions":["Tighten the offending path's permissions: `chmod o-w <path>` (e.g. make it 0755) for the binary and each parent directory.","Alternatively set the sticky bit if the directory must remain group/other writable: `chmod +t <dir>`.","Move/reinstall wasmer into a root-owned, non-world-writable location such as /usr/local/bin.","Re-run `wasmer binfmt register` after the permission change."],"exampleFix":"// before (fails)\nchmod 0777 /opt/wasmer/bin && wasmer binfmt register /opt/wasmer/bin/wasmer\n// after\nchmod 0755 /opt/wasmer/bin\nwasmer binfmt register /opt/wasmer/bin/wasmer","handlingStrategy":"validation","validationCode":"use std::os::unix::fs::PermissionsExt;\nfn is_world_writable_no_sticky(p: &Path) -> bool {\n    std::fs::metadata(p)\n        .map(|m| {\n            let mode = m.permissions().mode();\n            mode & 0o002 != 0 && mode & 0o1000 == 0\n        })\n        .unwrap_or(false)\n}\nif is_world_writable_no_sticky(Path::new(\"/opt/wasmer/bin/wasmer\")) {\n    eprintln!(\"chmod o-w the binary and its parents before registering\");\n}","typeGuard":"fn has_safe_mode(m: &std::fs::Metadata) -> bool {\n    let mode = m.permissions().mode();\n    mode & 0o002 == 0 || mode & 0o1000 != 0\n}","tryCatchPattern":"match binfmt_execute(path) {\n    Err(e) if e.to_string().contains(\"world writable and not sticky\") => {\n        eprintln!(\"Run `chmod o-w <path>` (or `chmod +t <dir>`) and retry\");\n    }\n    other => other?,\n}","preventionTips":["Install wasmer with 0755 perms and root ownership.","Avoid world-writable install directories; check `ls -ld` on every path component.","Set a restrictive umask (022) before installing.","On shared dirs that must be writable, ensure the sticky bit is set."],"tags":["filesystem","permissions","security","linux"],"backgroundTag":"world-writable-path","analyzedSha":"8c4b9ee9d33fb2068863fbb3d328683e7e6ff7f5","analyzedAt":"2026-09-01T23:06:31.009Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}