larksuite/cli · critical

%s: path %q is group-writable (mode %04o)

Error message

%s: path %q is group-writable (mode %04o)

What it means

The permission audit rejects group-writable files (mode & 0o020 != 0). Anyone in the file's group could modify a file used for secret or command resolution, so group-write is disallowed whenever the audit runs — AllowReadableByOthers only relaxes read checks, never write checks. This failure means the file's group has more access than the security model permits.

Source

Thrown at internal/binding/audit_unix.go:47

	}
	return nil
}

// auditFilePermissions rejects world/group-writable modes (always) and
// world/group-readable modes (unless allowReadableByOthers is true, which
// exec commands typically need for their usual 755 mode).
func auditFilePermissions(effectivePath string, allowReadableByOthers bool, label string) error {
	info, err := vfs.Stat(effectivePath)
	if err != nil {
		return fmt.Errorf("%s: cannot stat %q: %w", label, effectivePath, err)
	}
	mode := info.Mode().Perm()

	if mode&0o002 != 0 {
		return fmt.Errorf("%s: path %q is world-writable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o020 != 0 {
		return fmt.Errorf("%s: path %q is group-writable (mode %04o)", label, effectivePath, mode)
	}
	if allowReadableByOthers {
		return nil
	}
	if mode&0o004 != 0 {
		return fmt.Errorf("%s: path %q is world-readable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o040 != 0 {
		return fmt.Errorf("%s: path %q is group-readable (mode %04o)", label, effectivePath, mode)
	}
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. chmod g-w <path> — typically chmod 755 (executables) or 600 (private files), then re-run
2. Set umask 022 before creating files intended for the audit
3. Remove the user from the shared group if group sharing is no longer needed (affects new files)
4. Recreate the file under a personal group (chown user:user) so group-write semantics are under your control

Example fix

// before
-rwxrwxr-x deploy.sh   # group-writable
// after
chmod 755 deploy.sh
-rwxr-xr-x deploy.sh

func groupWritable(p string) (bool, error) {
  fi, err := os.Stat(p)
  if err != nil { return false, err }
  return fi.Mode().Perm()&0o020 != 0, nil
}
// fix before calling: if w, _ := groupWritable(p); w { os.Chmod(p, 0o755) }

When it happens

Trigger: AssertSecurePath audits a file whose permission bits include g+w (e.g. mode 0775, 0664) and the audit is active (AllowInsecurePath false). Group membership changes on shared hosts make this appear after a previously-clean file is re-audited.

Common situations: Default umask 002 on developer workstations (common on some Linux distros) producing 664/775 files; files edited via a shared group checkout; ACL/setup scripts that chmod 775 everything.

Related errors

• %s: path %q is owned by uid %d, expected %d
• %s: path %q is world-writable (mode %04o)
• %s: cannot stat %q: %w
• keychain access blocked
• %s: cannot resolve symlink %q: %w

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/81bf1662d63a14ab. Report an issue: GitHub.