larksuite/cli · error

%s: path %q is group-readable (mode %04o)

Error message

%s: path %q is group-readable (mode %04o)

What it means

Same Unix permission audit family: this variant fires when the file is group-readable (mode&0o040 set). The library rejects group-readable secret files because any user in the file's group could read credentials. It is only checked when allowReadableByOthers is false.

Source

Thrown at internal/binding/audit_unix.go:56

	if err != nil {
		return fmt.Errorf("%s: cannot stat %q: %w", label, effectivePath, err)
	}
	mode := info.Mode().Perm()

	if mode&0o002 != 0 {
		return fmt.Errorf("%s: path %q is world-writable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o020 != 0 {
		return fmt.Errorf("%s: path %q is group-writable (mode %04o)", label, effectivePath, mode)
	}
	if allowReadableByOthers {
		return nil
	}
	if mode&0o004 != 0 {
		return fmt.Errorf("%s: path %q is world-readable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o040 != 0 {
		return fmt.Errorf("%s: path %q is group-readable (mode %04o)", label, effectivePath, mode)
	}
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. chmod 0600 the reported path
2. Remove the group-read bit: `chmod g-r <path>`
3. Change the owning group or move the file out of a shared-group directory
4. Use allowReadableByOthers=true only if the caller genuinely permits group access

Example fix

// before
-rw-r-----  secret  (0640)
// after
chmod 600 secret   # -rw-------  (0600)

info, err := os.Stat(path)
if err != nil { return err }
if info.Mode().Perm()&0o040 != 0 {
    os.Chmod(path, 0600) // drop group-read before binding
}

When it happens

Trigger: auditFilePermissions with allowReadableByOthers=false and the stat'ed mode has the group-read bit set, e.g. 0640, 0660, 0750.

Common situations: Secret file assigned to a shared group by default group policy; `chown`/`chgrp` workflows; restrictive-umask setups that still add group read (umask 027 leaves g+r).

Related errors

• %s: path %q is world-readable (mode %04o)
• %s: path must be absolute, got %q
• %s: cannot stat %q: %w
• %s: path %q is a directory, not a file
• %s: path %q is a symlink (not allowed)

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/38e94e67b9e587ec. Report an issue: GitHub.