{"record":{"id":"f36e23086d0b9267","repo":"hashicorp/nomad","slug":"error-making-q-executable-s","errorCode":null,"errorMessage":"error making %q executable: %s","messagePattern":"error making %q executable: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/executor/executor.go","lineNumber":791,"sourceCode":"func makeExecutable(binPath string) error {\n\tif runtime.GOOS == \"windows\" {\n\t\treturn nil\n\t}\n\n\tfi, err := os.Stat(binPath)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\treturn fmt.Errorf(\"binary %q does not exist\", binPath)\n\t\t}\n\t\treturn fmt.Errorf(\"specified binary is invalid: %v\", err)\n\t}\n\n\t// If it is not executable, make it so.\n\tperm := fi.Mode().Perm()\n\treq := os.FileMode(0555)\n\tif perm&req != req {\n\t\tif err := os.Chmod(binPath, perm|req); err != nil {\n\t\t\treturn fmt.Errorf(\"error making %q executable: %s\", binPath, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// SupportedCaps returns a list of all supported capabilities in kernel.\nfunc SupportedCaps(allowNetRaw bool) []string {\n\tvar allCaps []string\n\tlist, _ := capability.ListSupported()\n\tfor _, cap := range list {\n\t\tif !allowNetRaw && cap == capability.CAP_NET_RAW {\n\t\t\tcontinue\n\t\t}\n\t\tallCaps = append(allCaps, fmt.Sprintf(\"CAP_%s\", strings.ToUpper(cap.String())))\n\t}\n\treturn allCaps\n}\n","sourceCodeStart":773,"sourceCodeEnd":809,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/executor/executor.go#L773-L809","documentation":"This error is wrapped by makeExecutable in the Nomad executor when os.Chmod fails while trying to grant at least mode 0555 (read+execute) to the task's binary. Nomad requires the binary to be executable inside the task's chroot, so before launching it checks the current permission bits and ORs in 0555 if they are missing. The underlying chmod failure is embedded in the %s suffix.","triggerScenarios":"os.Chmod(binPath, perm|0555) returns an error: the file is on a read-only filesystem, the executor user lacks ownership/chmod rights, or the binary path was removed between the stat and the chmod.","commonSituations":"Task binary mounted from a read-only volume or artifact; the alloc dir lives on a filesystem mounted noexec/immutable; running the driver as an unprivileged user without write access to the binary; binary deleted by another task or GC between check and chmod.","solutions":["Check ownership and permissions of the binary path (ls -l) and ensure the Nomad/executor process user can chmod it","Verify the filesystem backing the task dir is writable and not mounted read-only or noexec","Confirm lookupTaskBin returned the host path of the binary and that it still exists at chmod time","Re-download/re-stage the artifact if the binary vanished mid-launch"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"fi, err := os.Stat(binPath)\nif err != nil { return fmt.Errorf(\"binary missing: %w\", err) }\nif fi.Mode().Perm()&0o555 != 0o555 {\n    if err := os.Chmod(binPath, fi.Mode().Perm()|0o555); err != nil {\n        return fmt.Errorf(\"pre-flight chmod failed for %s: %w\", binPath, err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-chmod artifacts to 0555 at download time instead of relying on the executor","Ensure the alloc dir filesystem is writable and not mounted read-only/noexec","Run the executor with a user that owns or can chmod task binaries","Verify the binary path exists immediately before launch"],"tags":["filesystem","permissions","chmod","executor"],"backgroundTag":"chmod-permission-denied","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}