chenhg5/cc-connect · error

project %q audit: %s

Error message

project %q audit: %s

What it means

After a successful isolation probe, runRunAsUserStartupChecks iterates o.audit.Fatal findings and wraps each as `project %q audit: %s`. These are isolation violations discovered by the probe (cross-user access to sensitive paths, unexpected identity, etc.).

Source

Thrown at cmd/cc-connect/runas_startup.go:150

		if o.preflight.HasFatal() {
			continue
		}
		if o.auditErr != nil {
			slog.Error("run_as_user: isolation probe failed to run",
				"project", o.project, "error", o.auditErr)
			fatals = append(fatals, fmt.Errorf("project %q probe: %w", o.project, o.auditErr))
			continue
		}
		slog.Info("run_as_user: isolation audit completed",
			"project", o.project,
			"whoami", o.audit.Identity.Whoami,
			"workdir_writable", o.audit.WorkDirStatus.Writable,
			"target_paths", len(o.audit.TargetPaths),
			"cross_user_results", len(o.audit.CrossUser),
		)
		for _, f := range o.audit.Fatal {
			slog.Error("run_as_user: audit FATAL", "project", o.project, "error", f)
			fatals = append(fatals, fmt.Errorf("project %q audit: %s", o.project, f))
		}
	}

	if len(fatals) > 0 {
		return fmt.Errorf("run_as_user startup checks failed for %d project(s); see logs above", len(fatals))
	}
	return nil
}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Locate the 'run_as_user: audit FATAL' log lines listing each specific finding.
2. Restrict the offending target paths (chmod/chown so the run-as user cannot access them).
3. If a path is intentionally shared, move it out of the audited target set or adjust project configuration; re-run to confirm clean.

Example fix

// before
chmod 777 /home/user/data
// after
chown user:user /home/user/data && chmod 750 /home/user/data

# ensure run-as user cannot reach sensitive targets
for p in "$TARGET_PATHS"; do sudo -u "$RUNAS_USER" test -r "$p" && echo "VIOLATION: readable $p"; done

if err := runRunAsUserStartupChecks(ctx); err != nil {
    if strings.Contains(err.Error(), "audit:") {
        slog.Error("isolation audit found violations; tighten target path permissions")
    }
    return err
}

When it happens

Trigger: The isolation audit ran and found fatal findings: e.g. cross_user results showing the run-as user can read/write target paths it shouldn't, or workdir writable check reveals unsafe permissions.

Common situations: Target paths world-writable or group-shared with the run-as user; run-as user accidentally in the same group as the primary user; over-broad ACLs after copying configs.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• project %q preflight: %w
• project %q probe: %w
• run_as_user startup checks failed for %d project(s); see log
• platform %q not ready
• chmod unit file: %w

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/3460cb0cf31619d4. Report an issue: GitHub.