lima-vm/lima · error

invalid permissions %#q for path %#q: %w

Error message

invalid permissions %#q for path %#q: %w

What it means

The fake cloud-init implementation for macOS hosts parses the `permissions` field of each `write_files` user-data entry as an octal number (e.g. "0644"). If `strconv.ParseUint(entry.Permissions, 8, 32)` fails, this error is thrown and provisioning of the user data aborts. It wraps the parse error, so the wrapped text names the exact invalid character.

Source

Thrown at pkg/guestagent/fakecloudinit/fakecloudinit_darwin.go:347

	if err != nil {
		return fmt.Errorf("failed to open sudoers file %#q: %w", sudoersPath, err)
	}
	if _, err = fmt.Fprintf(f, "%s %s\n", userName, sudo); err != nil {
		_ = f.Close()
		return fmt.Errorf("failed to write to sudoers file %#q for user %#q: %w", sudoersPath, userName, err)
	}
	return f.Close()
}

func writeFiles(ctx context.Context, entry cloudinittypes.WriteFile) error {
	if entry.Path == "" {
		return errors.New("path is required for write_files entry")
	}
	perm := os.FileMode(0o644)
	if entry.Permissions != "" {
		p, err := strconv.ParseUint(entry.Permissions, 8, 32)
		if err != nil {
			return fmt.Errorf("invalid permissions %#q for path %#q: %w", entry.Permissions, entry.Path, err)
		}
		perm = os.FileMode(p)
	}
	if err := os.MkdirAll(filepath.Dir(entry.Path), 0o755); err != nil {
		return fmt.Errorf("failed to create parent directory for path %#q: %w", entry.Path, err)
	}
	if err := os.WriteFile(entry.Path, []byte(entry.Content), perm); err != nil {
		return fmt.Errorf("failed to write file for path %#q: %w", entry.Path, err)
	}
	if entry.Owner != "" {
		cmd := exec.CommandContext(ctx, "chown", entry.Owner, entry.Path)
		logrus.Infof("Executing command: %v", cmd.Args)
		if output, err := cmd.CombinedOutput(); err != nil {
			return fmt.Errorf("failed to execute command %v: %w (output=%#q)", cmd.Args, err, output)
		}
	}
	return nil
}

View on GitHub (pinned to dd909d0973)

Solutions

1. Fix the `permissions` field in the write_files entry to be a plain octal string such as "0644" or "0600".
2. Remove the `permissions` field entirely if the default 0644 is acceptable.
3. Check the wrapped parse error in the message to identify the offending character in the permissions string.
4. Validate the user-data YAML with a cloud-init schema checker before provisioning.

Example fix

// before
permissions: "u=rw,go=r"
// after
permissions: "0644"

for _, e := range userData.WriteFiles {
    if e.Permissions != "" {
        if _, err := strconv.ParseUint(e.Permissions, 8, 32); err != nil {
            return fmt.Errorf("entry %s: invalid octal permissions %q", e.Path, e.Permissions)
        }
    }
}

if err := processUserData(ctx, data); err != nil {
    var parseErr *strconv.NumError
    if errors.As(err, &parseErr) {
        // fix the permissions field reported in the message
    }
}

When it happens

Trigger: A write_files entry in the user-data consumed by the Lima macOS guestagent has a `permissions` string that is not a valid base-8 uint32, e.g. "644" with a typo like "rwxr-xr-x", "0o644", "", negative values, or values above 0777 with non-octal digits like 8 or 9.

Common situations: Copy-pasting Linux symbolic permission strings into cloud-init YAML; using the Go-style `0o644` prefix instead of plain `0644`; hand-editing templates and leaving a placeholder or comment in the permissions field.

Related errors

• failed to create parent directory for path %#q: %w
• failed to install plist to %s: %w
• failed to remove %s: %w
• no SSH key was found, run `ssh-keygen`
• failed to enable SSHD: %w

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/5c644d4331735316. Report an issue: GitHub.