larksuite/cli · error

: path is group-readable (mode %04o)

Error message

%s: path %q is group-readable (mode %04o)

What it means

Same Unix permission audit family: this variant fires when the file is group-readable (mode&0o040 set). The library rejects group-readable secret files because any user in the file's group could read credentials. It is only checked when allowReadableByOthers is false.

Solutions

1. chmod 0600 the reported path
2. Remove the group-read bit: `chmod g-r <path>`
3. Change the owning group or move the file out of a shared-group directory
4. Use allowReadableByOthers=true only if the caller genuinely permits group access

Example fix

// before
-rw-r-----  secret  (0640)
// after
chmod 600 secret   # -rw-------  (0600)

info, err := os.Stat(path)
if err != nil { return err }
if info.Mode().Perm()&0o040 != 0 {
    os.Chmod(path, 0600) // drop group-read before binding
}

When it happens

Trigger: auditFilePermissions with allowReadableByOthers=false and the stat'ed mode has the group-read bit set, e.g. 0640, 0660, 0750.

Common situations: Secret file assigned to a shared group by default group policy; `chown`/`chgrp` workflows; restrictive-umask setups that still add group read (umask 027 leaves g+r).

Related errors

• : path is world-readable (mode %04o)
• busdiscover: read events dir
• cannot inspect path
• cannot resolve symlinks
• create config dir

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/38e94e67b9e587ec. Report an issue: GitHub.

Appendix: source

Thrown at internal/binding/audit_unix.go:56

	if err != nil {
		return fmt.Errorf("%s: cannot stat %q: %w", label, effectivePath, err)
	}
	mode := info.Mode().Perm()

	if mode&0o002 != 0 {
		return fmt.Errorf("%s: path %q is world-writable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o020 != 0 {
		return fmt.Errorf("%s: path %q is group-writable (mode %04o)", label, effectivePath, mode)
	}
	if allowReadableByOthers {
		return nil
	}
	if mode&0o004 != 0 {
		return fmt.Errorf("%s: path %q is world-readable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o040 != 0 {
		return fmt.Errorf("%s: path %q is group-readable (mode %04o)", label, effectivePath, mode)
	}
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)