What causes "%s: path %q is world-readable (mode %04o)" in larksuite/cli?

chmod 0600 the reported path (e.g. `chmod 600 ~/.lark-channel/secret`)

%s: path %q is world-readable (mode %04o)

Error message

%s: path %q is world-readable (mode %04o)

What it means

This error comes from the Unix permission audit performed before binding a credential file. The audit always rejects world/group-writable files and, unless the caller explicitly allows readable-by-others modes (e.g. exec scripts needing 0755), also rejects world-readable files. It fires when the file's permission bits include the other-read bit (0o004), meaning any user on the host can read the (potentially secret) file.

Source

Thrown at internal/binding/audit_unix.go:53

// exec commands typically need for their usual 755 mode).
func auditFilePermissions(effectivePath string, allowReadableByOthers bool, label string) error {
	info, err := vfs.Stat(effectivePath)
	if err != nil {
		return fmt.Errorf("%s: cannot stat %q: %w", label, effectivePath, err)
	}
	mode := info.Mode().Perm()

	if mode&0o002 != 0 {
		return fmt.Errorf("%s: path %q is world-writable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o020 != 0 {
		return fmt.Errorf("%s: path %q is group-writable (mode %04o)", label, effectivePath, mode)
	}
	if allowReadableByOthers {
		return nil
	}
	if mode&0o004 != 0 {
		return fmt.Errorf("%s: path %q is world-readable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o040 != 0 {
		return fmt.Errorf("%s: path %q is group-readable (mode %04o)", label, effectivePath, mode)
	}
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

chmod 0600 the reported path (e.g. `chmod 600 ~/.lark-channel/secret`)
Fix the creating code to use os.Chmod / WriteFile mode 0600 (or 0400)
If the file legitimately must be world-readable (an exec helper script), invoke the audit with allowReadableByOthers=true

Example fix

// before
os.WriteFile(path, data, 0644)
// after
os.WriteFile(path, data, 0600)

Defensive patterns

Strategy: validation

Validate before calling

info, err := os.Stat(path)
if err != nil { return err }
if info.Mode().Perm()&0o004 != 0 {
    os.Chmod(path, 0600) // tighten before the API call
}

Prevention

Create secret files with mode 0600 (or 0400) at write time
Set a restrictive umask (077) in scripts that provision credentials
Audit permission bits after copying or moving secret files

When it happens

Trigger: auditFilePermissions(effectivePath, allowReadableByOthers=false, label) stats the file and mode&0o004 != 0 — i.e. the file was created or chmod'ed with a mode like 0644 or 0645 while secrets should be 0600.

Common situations: Creating a secret file with os.WriteFile default 0644 instead of 0600; umask too permissive; copying a secret with cp (which preserves default modes); a CLI-run helper script left world-readable.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/8a448a539e74ae5d. Report an issue: GitHub.