larksuite/cli · critical

%s: path %q is world-writable (mode %04o)

Error message

%s: path %q is world-writable (mode %04o)

What it means

The permission audit always rejects world-writable files (mode & 0o002 != 0). A world-writable file bound into secrets or command resolution can be modified by any user on the system, so the library refuses it unconditionally — even when AllowInsecurePath-style leniency exists for other checks, world-writable is treated as never acceptable.

Source

Thrown at internal/binding/audit_unix.go:44

	if sysStat.Uid != uint32(os.Getuid()) {
		return fmt.Errorf("%s: path %q is owned by uid %d, expected %d",
			label, path, sysStat.Uid, os.Getuid())
	}
	return nil
}

// auditFilePermissions rejects world/group-writable modes (always) and
// world/group-readable modes (unless allowReadableByOthers is true, which
// exec commands typically need for their usual 755 mode).
func auditFilePermissions(effectivePath string, allowReadableByOthers bool, label string) error {
	info, err := vfs.Stat(effectivePath)
	if err != nil {
		return fmt.Errorf("%s: cannot stat %q: %w", label, effectivePath, err)
	}
	mode := info.Mode().Perm()

	if mode&0o002 != 0 {
		return fmt.Errorf("%s: path %q is world-writable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o020 != 0 {
		return fmt.Errorf("%s: path %q is group-writable (mode %04o)", label, effectivePath, mode)
	}
	if allowReadableByOthers {
		return nil
	}
	if mode&0o004 != 0 {
		return fmt.Errorf("%s: path %q is world-readable (mode %04o)", label, effectivePath, mode)
	}
	if mode&0o040 != 0 {
		return fmt.Errorf("%s: path %q is group-readable (mode %04o)", label, effectivePath, mode)
	}
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. chmod o-w <path> — typically chmod 755 for executables or 600 for private files, then re-run
2. Fix the umask used to create the file (e.g. umask 022) and recreate it
3. Move the file off FAT/exFAT/SMB mounts that cannot represent permission bits onto a POSIX filesystem
4. If the file must stay shared, place it in a directory the audit permits and have a trusted owner manage it with group-writable removed

Example fix

// before
-rwxrwxrwx tool.sh
// after
chmod 755 tool.sh  # or chmod 600 for non-executable secret files
-rwxr-xr-x tool.sh

func worldWritable(p string) (bool, error) {
  fi, err := os.Stat(p)
  if err != nil { return false, err }
  return fi.Mode().Perm()&0o002 != 0, nil
}
// fix before calling: if w, _ := worldWritable(p); w { os.Chmod(p, 0o755) }

When it happens

Trigger: AssertSecurePath with the default security settings audits a file whose permission bits include the o+w bit (e.g. mode 0777, 0775 without group, or any mode with 0o002 set) after passing ownership checks order-independent of mode.

Common situations: Scripts shared via chmod 777 'to make it work'; files created by installers with umask 000; files on FAT/exFAT or SMB mounts that report 0777 for everything; samba/NFS shares exporting everything world-writable.

Related errors

• %s: path %q is owned by uid %d, expected %d
• %s: path %q is group-writable (mode %04o)
• %s: cannot stat %q: %w
• keychain access blocked
• %s: cannot resolve symlink %q: %w

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/3f3f48eba99b3766. Report an issue: GitHub.