{"record":{"id":"e015331e53723841","repo":"kovidgoyal/kitty","slug":"incorrect-permissions-on-shm-file","errorCode":null,"errorMessage":"Incorrect permissions on SHM file","messagePattern":"Incorrect permissions on SHM file","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"kittens/ssh/main.go","lineNumber":82,"sourceCode":"\t} else if strings.Contains(hostname, \"@\") && hostname[0] != '@' {\n\t\tusername, hostname_for_match, _ = strings.Cut(hostname, \"@\")\n\t\tparsed = true\n\t}\n\tif !parsed && strings.Contains(hostname, \"@\") && hostname[0] != '@' {\n\t\t_, hostname_for_match, _ = strings.Cut(hostname, \"@\")\n\t}\n\treturn\n}\n\nfunc read_data_from_shared_memory(shm_name string) ([]byte, error) {\n\tdata, err := shm.ReadWithSizeAndUnlink(shm_name, func(s fs.FileInfo) error {\n\t\tif stat, ok := s.Sys().(syscall.Stat_t); ok {\n\t\t\tif os.Getuid() != int(stat.Uid) || os.Getgid() != int(stat.Gid) {\n\t\t\t\treturn fmt.Errorf(\"Incorrect owner on SHM file\")\n\t\t\t}\n\t\t}\n\t\tif s.Mode().Perm() != 0o600 {\n\t\t\treturn fmt.Errorf(\"Incorrect permissions on SHM file\")\n\t\t}\n\t\treturn nil\n\t})\n\treturn data, err\n}\n\nfunc add_cloned_env(val string) (ans map[string]string, err error) {\n\tdata, err := read_data_from_shared_memory(val)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\terr = json.Unmarshal(data, &ans)\n\treturn ans, err\n}\n\nfunc parse_kitten_args(found_extra_args []string, username, hostname_for_match string) (overrides []string, literal_env map[string]string, ferr error) {\n\tliteral_env = make(map[string]string)\n\toverrides = make([]string, 0, 4)","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/kovidgoyal/kitty/blob/6d5d0c440603ad9bdf6dcd599f73f6dde21acb44/kittens/ssh/main.go#L64-L100","documentation":"Companion check to the owner verification: the /dev/shm bootstrap file must have exactly 0600 permissions. Looser modes would let other local users read the transmitted data (which can include sensitive payloads), so the read is aborted.","triggerScenarios":"read_data_from_shared_memory seeing a shm file whose mode bits are not 0600 — e.g. created under a permissive umask (0002/0666 gone wide), or chmod'ed afterwards, or a foreign file with the same name.","commonSituations":"Users with umask 000 in shell profiles; containers or CI images with odd umask defaults; multi-user systems; files copied into /dev/shm manually for debugging.","solutions":["Fix your umask before launching kitty (e.g. umask 022 or 077)","Delete and let the kitten recreate the file: rm /dev/shm/<name> and rerun","Verify no other tool/user is pre-creating the shm file: ls -l /dev/shm/","If it recurs, audit what writes to /dev/shm with wide modes (could be tampering)"],"exampleFix":"# before\numask 000\nkitty +kitten ssh user@host\n# after\numask 077\nkitty +kitten ssh user@host","handlingStrategy":"try-catch","validationCode":"if info, err := os.Stat(shmPath); err == nil && info.Mode().Perm() != 0o600 {\n    os.Chmod(shmPath, 0o600) // or remove to force recreation\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"Incorrect permissions\") {\n    os.Remove(shmPath) // recreate with correct mode\n}","preventionTips":["Set umask 077 (or at least restrictive) in shells that launch kitty","Audit /dev/shm for wide-mode files on shared hosts"],"tags":["ssh-kitten","shared-memory","security","file-mode"],"backgroundTag":"insecure-temp-file-permissions","analyzedSha":"6d5d0c440603ad9bdf6dcd599f73f6dde21acb44","analyzedAt":"2026-08-27T14:20:20.142Z","schemaVersion":2},"datasetVersion":"2026-08-27T19:17:21.184Z"}