{"record":{"id":"df50b894ae342562","repo":"ipfs/kubo","slug":"chmod-temp-file-w","errorCode":null,"errorMessage":"chmod temp file: %w","messagePattern":"chmod temp file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/update.go","lineNumber":741,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"creating temp file: %w\", err)\n\t}\n\tdefer func() {\n\t\tif cerr := f.Close(); cerr != nil && err == nil {\n\t\t\terr = fmt.Errorf(\"closing temp file: %w\", cerr)\n\t\t}\n\t\tif err != nil {\n\t\t\tos.Remove(f.Name())\n\t\t}\n\t}()\n\n\tif _, err = f.Write(data); err != nil {\n\t\treturn \"\", fmt.Errorf(\"writing temp file: %w\", err)\n\t}\n\tif err = f.Sync(); err != nil {\n\t\treturn \"\", fmt.Errorf(\"syncing temp file: %w\", err)\n\t}\n\tif err = f.Chmod(0o755); err != nil {\n\t\treturn \"\", fmt.Errorf(\"chmod temp file: %w\", err)\n\t}\n\treturn f.Name(), nil\n}\n\n// extractBinaryFromArchive extracts the kubo/ipfs binary from a tar.gz or zip archive.\nfunc extractBinaryFromArchive(data []byte) ([]byte, error) {\n\tbinName := migrations.ExeName(\"ipfs\")\n\n\t// Try tar.gz first (Unix releases), then zip (Windows releases).\n\tresult, tarErr := extractFromTarGz(data, binName)\n\tif tarErr == nil {\n\t\treturn result, nil\n\t}\n\n\tresult, zipErr := extractFromZip(data, binName)\n\tif zipErr == nil {\n\t\treturn result, nil\n\t}","sourceCodeStart":723,"sourceCodeEnd":759,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/update.go#L723-L759","documentation":"After writing and syncing the staged binary, `writeBinaryToTempFile` calls `f.Chmod(0o755)` so the temp file is executable before replacing the installed kubo binary. This error wraps a chmod failure; without the execute bit the staged file is unusable as a binary, so the update aborts.","triggerScenarios":"`ipfs update install` when chmod fails on the temp file: the filesystem does not support permission changes (some FAT/exFAT mounts, certain network filesystems), or an ACL/MAC policy (SELinux) denies the change.","commonSituations":"TMPDIR on a USB stick or Windows-formatted (vfat/exFAT/ntfs-3g) mount that mangles exec bits; restrictive umask/ACLs on the temp dir; SELinux denials in enforcing mode.","solutions":["Point TMPDIR at a POSIX filesystem that honors exec bits: `export TMPDIR=/var/tmp` and rerun.","If on exFAT/vfat, remount with proper options (e.g. `fmask=022`) or move to ext4/xfs.","Check MAC-policy denials: `sudo ausearch -m avc -ts recent` for SELinux; adjust policy or use `setenforce 0` temporarily to confirm.","Retry after fixing; the aborted temp file is removed automatically."],"exampleFix":"# before\nexport TMPDIR=/mnt/usbstick   # exFAT: chmod not supported\nipfs update install v0.30.0   # chmod temp file: operation not permitted\n\n# after\nexport TMPDIR=/var/tmp        # ext4 honors 0755\nipfs update install v0.30.0","handlingStrategy":"validation","validationCode":"// verify the temp dir supports exec bits before updating\nprobe, _ := os.CreateTemp(os.TempDir(), \".chmod-probe-*\")\nif err := probe.Chmod(0o755); err != nil {\n\t// chmod unsupported (vfat/exFAT or MAC policy): repoint TMPDIR first\n}\nprobe.Close()\nos.Remove(probe.Name())","typeGuard":"func supportsExecBits(dir string) bool {\n\tf, err := os.CreateTemp(dir, \".probe-*\")\n\tif err != nil {\n\t\treturn false\n\t}\n\tdefer f.Close()\n\tdefer os.Remove(f.Name())\n\tif f.Chmod(0o755) != nil {\n\t\treturn false\n\t}\n\tfi, _ := os.Stat(f.Name())\n\treturn fi.Mode().Perm() == 0o755\n}","tryCatchPattern":"path, err := writeBinaryToTempFile(data, ver)\nif err != nil {\n\tif strings.Contains(err.Error(), \"chmod temp file\") {\n\t\t// fallback: use a POSIX FS for temp, or remount with fmask=022\n\t\tos.Setenv(\"TMPDIR\", \"/var/tmp\")\n\t\treturn retryUpdate()\n\t}\n\treturn err\n}","preventionTips":["Never point TMPDIR at vfat/exFAT/ntfs-3g mounts for binary staging.","Check SELinux/AppArmor AVC denials if permissions look correct but chmod fails.","Verify the staged file's mode (0755) on any custom update tooling.","Use distribution-standard temp directories (/tmp, /var/tmp) in automation."],"tags":["filesystem","permissions","chmod","update"],"backgroundTag":"chmod-failed","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}