{"record":{"id":"f32032d3dac3e3da","repo":"vxcontrol/pentagi","slug":"failed-to-set-temporary-upload-file-permissions","errorCode":null,"errorMessage":"failed to set temporary upload file permissions: %w","messagePattern":"failed to set temporary upload file permissions: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"backend/pkg/flowfiles/files.go","lineNumber":337,"sourceCode":"\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to open uploaded file: %w\", err)\n\t}\n\tdefer src.Close()\n\n\tdst, err := os.CreateTemp(dir, \".upload-*\")\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to create temporary upload file: %w\", err)\n\t}\n\ttmpPath := dst.Name()\n\tdefer dst.Close()\n\n\tif _, err := io.Copy(dst, src); err != nil {\n\t\tos.Remove(tmpPath)\n\t\treturn \"\", fmt.Errorf(\"failed to write temporary upload file: %w\", err)\n\t}\n\tif err := dst.Chmod(0644); err != nil {\n\t\tos.Remove(tmpPath)\n\t\treturn \"\", fmt.Errorf(\"failed to set temporary upload file permissions: %w\", err)\n\t}\n\n\treturn tmpPath, nil\n}\n\nfunc IsWithinDir(absPath, dir string) bool {\n\treturn strings.HasPrefix(\n\t\tfilepath.Clean(absPath)+string(filepath.Separator),\n\t\tfilepath.Clean(dir)+string(filepath.Separator),\n\t)\n}\n\nfunc ResolvePulledStagedTarget(stagingDir, cacheRelPath string) string {\n\tcandidates := []string{\n\t\tfilepath.Join(stagingDir, filepath.FromSlash(cacheRelPath)),\n\t\tfilepath.Join(stagingDir, path.Base(cacheRelPath)),\n\t}\n","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/flowfiles/files.go#L319-L355","documentation":"After a successful copy, SaveUploadedFileToTemp normalizes the temp file mode to 0644 via dst.Chmod. If the Chmod call fails, the temp file is removed and this error is returned. On standard Linux filesystems Chmod on a file you own essentially never fails; it mostly appears on exotic filesystems or unusual mount options.","triggerScenarios":"dst.Chmod(0644) returns an error: dir is on a filesystem that does not support chmod (some NFS configs, certain FUSE/S3 mounts, Windows shares), or the file was externally removed/closed abnormally.","commonSituations":"Backing the upload dir with an S3/FUSE mount or CIFS share that rejects permission changes; a custom os.Chmod-disallowing LSM policy; unusual container security profiles (read-only mounts are caught earlier at CreateTemp).","solutions":["Move the upload temp dir to a local POSIX filesystem (e.g. /tmp or a local volume) instead of a network/object-store mount.","If the storage backend ignores permissions by design, check whether the wrapped error is benign (ENOTSUP/EINVAL on chmod) and tolerate it.","Verify the process owns the created temp file and no security module blocks chmod."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"var probeFile, err = func() (*os.File, error) {\n    f, err := os.CreateTemp(dir, \".permprobe-*\")\n    if err != nil { return nil, err }\n    defer f.Close()\n    if err := f.Chmod(0o644); err != nil {\n        return nil, fmt.Errorf(\"chmod unsupported on %s: %w\", dir, err)\n    }\n    os.Remove(f.Name())\n    return f, nil\n}","typeGuard":null,"tryCatchPattern":"tmpPath, err := flowfiles.SaveUploadedFileToTemp(fh, dir)\nif err != nil {\n    var pe *fs.PathError\n    if errors.As(err, &pe) && (errors.Is(pe.Err, syscall.ENOTSUP) || errors.Is(pe.Err, syscall.EINVAL)) {\n        log.Warn().Err(err).Msg(\"chmod unsupported on this filesystem; using umask default\")\n        // fall back to a manual copy without Chmod if the strict mode is not required\n        return\n    }\n    return err\n}","preventionTips":["Use local POSIX filesystems (ext4/xfs/tmpfs) for temp upload dirs, not S3-FUSE/CIFS/NFS mounts with restricted chmod.","Set a restrictive umask (e.g. 022) so temp files are already 0644 without needing Chmod.","Smoke-test the storage backend's permission semantics in CI before deploying."],"tags":["filesystem","permissions","chmod","temp-file"],"backgroundTag":"chmod-permission-denied","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}