{"record":{"id":"d1866cddfe454271","repo":"lima-vm/lima","slug":"failed-to-chown-q-for-user-q-w","errorCode":null,"errorMessage":"failed to chown %#q for user %#q: %w","messagePattern":"failed to chown %#q for user %#q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go","lineNumber":307,"sourceCode":"\n\tpwPath := filepath.Join(homedir, \"password\")\n\tif err = os.WriteFile(pwPath, []byte(pw+\"\\n\"), 0o400); err != nil {\n\t\treturn fmt.Errorf(\"failed to write password file for user %#q: %w\", u.Name, err)\n\t}\n\tlogrus.Infof(\"Created user %#q. The password is stored in %#q\", u.Name, pwPath)\n\n\tdotSSHPath := filepath.Join(homedir, \".ssh\")\n\tif err = os.MkdirAll(dotSSHPath, 0o700); err != nil {\n\t\treturn fmt.Errorf(\"failed to create .ssh directory for user %#q: %w\", u.Name, err)\n\t}\n\tauthKeysPath := filepath.Join(dotSSHPath, \"authorized_keys\")\n\tauthKeysContent := strings.Join(u.SSHAuthorizedKeys, \"\\n\")\n\tif err = os.WriteFile(authKeysPath, []byte(authKeysContent), 0o600); err != nil {\n\t\treturn fmt.Errorf(\"failed to write authorized_keys file for user %#q: %w\", u.Name, err)\n\t}\n\tfor _, f := range []string{pwPath, dotSSHPath, authKeysPath} {\n\t\tif err = os.Chown(f, uid, -1); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to chown %#q for user %#q: %w\", f, u.Name, err)\n\t\t}\n\t}\n\tif u.Sudo != \"\" {\n\t\tif err := writeSudoers(u.Name, u.Sudo); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to write sudoers file for user %#q: %w\", u.Name, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// writeSudoers appends a sudoers entry for the given user.\n// writeSudoers is expected be called only once on creating the user account.\nfunc writeSudoers(userName, sudo string) error {\n\tif strings.Contains(sudo, \"\\n\") {\n\t\treturn errors.New(\"sudo field must not contain newline characters\")\n\t}\n\tif err := os.MkdirAll(\"/etc/sudoers.d\", 0o700); err != nil {\n\t\treturn fmt.Errorf(\"failed to create /etc/sudoers.d directory: %w\", err)","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go#L289-L325","documentation":"os.Chown failed while assigning the user's UID to the password file, the `.ssh` directory, or `authorized_keys` (group is left unchanged via gid -1). The agent needs these files owned by the new user so SSH login and password retrieval work. The error names the exact file path (`%#q`) that failed.","triggerScenarios":"os.Chown(f, uid, -1) returns an error in createUser for one of pwPath, dotSSHPath, or authKeysPath, during processUserData on darwin. Common causes: the requested UID does not exist/reserve on the system (e.g. macOS Setup Assistant assigned a different UID and the Lookup fallback was skipped or failed), or the process lacks root privileges.","commonSituations":"User-data requests a UID already taken or reserved on macOS; agent runs without root; chown restrictions from sandbox/MDM profiles; UID collision when a prior user with the same UID exists.","solutions":["Confirm the guestagent runs as root (chown requires privileges)","Check the log line 'Requested UID ... but the system assigned UID ...' for UID conflicts and pick a free UID in user-data","Verify the UID in the users entry is numeric and not already in use (`dscl . -list /users UniqueID`)","Inspect the wrapped errno (EPERM/EINVAL) for the failing path shown in the message"],"exampleFix":"// before\nusers:\n- name: alice\n  uid: \"501\"   # already used by the default macOS user\n// after\nusers:\n- name: alice\n  uid: \"502\"","handlingStrategy":"validation","validationCode":"// verify the requested UID is free on the macOS guest\nout, err := exec.Command(\"dscl\", \".\", \"-list\", \"/users\", \"UniqueID\").Output()\nif err == nil && strings.Contains(string(out), \"\\t\"+uid+\"\\n\") {\n    return fmt.Errorf(\"uid %s already in use; pick another\", uid)\n}\nif os.Geteuid() != 0 {\n    return errors.New(\"chown requires root; run guestagent as root\")\n}","typeGuard":null,"tryCatchPattern":"if err := processUserData(ctx, data); err != nil {\n    var se *os.LinkError\n    if errors.As(err, &se) && strings.Contains(err.Error(), \"chown\") {\n        log.Printf(\"chown failed (perm=%d): %v — check UID conflicts and root privileges\", se.Perm, se.Err)\n    }\n}","preventionTips":["Run the guestagent as root","Choose UIDs that do not collide with existing macOS users (check dscl output)","Rely on the agent's UID-lookup fallback logs to detect reassignments early"],"tags":["permissions","chown","macos","guestagent"],"backgroundTag":"chown-failed","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}