wasmerio/wasmer · error

Can't check permissions of {}

Error message

Can't check permissions of {}

What it means

The `wasmer binfmt` command performs a security check (`seccheck`) that walks a path and reads filesystem metadata for each component before registering wasmer as a binfmt interpreter. This error wraps a failure of `std::fs::metadata` — the file or a parent directory could not be stat'ed (missing, permission denied, broken symlink, etc.).

Source

Thrown at lib/cli/src/commands/binfmt.rs:52

    #[clap(long, default_value = "/proc/sys/fs/binfmt_misc/")]
    binfmt_misc: PathBuf,

    #[clap(subcommand)]
    action: Action,
}

// Quick safety check:
// This folder isn't world writable (or else its sticky bit is set), and neither are its parents.
//
// If somebody mounted /tmp wrong, this might result in a TOCTOU problem.
fn seccheck(path: &Path) -> Result<()> {
    if let Some(parent) = path.parent() {
        seccheck(parent)?;
    }
    let m = std::fs::metadata(path)
        .with_context(|| format!("Can't check permissions of {}", path.to_string_lossy()))?;
    use unix_mode::*;
    anyhow::ensure!(
        !is_allowed(Accessor::Other, Access::Write, m.mode()) || is_sticky(m.mode()),
        "{} is world writable and not sticky ({m:?})",
        path.to_string_lossy()
    );
    Ok(())
}

impl Binfmt {
    /// The filename used to register the wasmer CLI as a binfmt interpreter.
    pub const FILENAME: &'static str = "wasmer-binfmt-interpreter";

    /// execute [Binfmt]
    pub fn execute(&self) -> Result<()> {
        if !self.binfmt_misc.exists() {
            bail!("{} does not exist", self.binfmt_misc.to_string_lossy());
        }
        let temp_dir;
        let specs = match self.action {

View on GitHub (pinned to 8c4b9ee9d3)

Solutions

1. Verify the path printed in the error exists: `ls -la <path>`; reinstall wasmer if the binary is missing.
2. Fix permissions on the missing parent directory (chmod/chown) so the current user can traverse it.
3. Run the command with appropriate privileges (sudo) if the binfmt registration requires it and the path is root-only.
4. If the path is a dangling symlink, recreate or update it to point at the real wasmer binary.

Example fix

// before
wasmer binfmt register /opt/wasmer/bin/wasmer  // path missing
// after
sudo ln -s $(which wasmer) /usr/local/bin/wasmer
wasmer binfmt register /usr/local/bin/wasmer

fn path_is_statable(p: &Path) -> bool {
    std::fs::metadata(p).is_ok()
}
// call before binfmt register:
if !path_is_statable(Path::new("/path/to/wasmer")) {
    eprintln!("wasmer binary path missing or unreachable");
}

fn resolves_to_file(p: &Path) -> bool {
    std::fs::metadata(p).map(|m| m.is_file()).unwrap_or(false)
}

match binfmt_execute(path) {
    Err(e) if e.to_string().contains("Can't check permissions of") => {
        eprintln!("Fix path/permissions, then retry: {e}");
    }
    other => other?,
}

When it happens

Trigger: Calling `seccheck` (directly or via `Binfmt::execute`) on a path where `std::fs::metadata(path)` fails: the path does not exist, a parent directory lacks search (execute) permission, the path is a dangling symlink, or an I/O error occurs during traversal.

Common situations: Running `wasmer binfmt register` with a typo'd interpreter path; wasmer installed in a directory later removed; restrictive parent directory permissions (e.g. root-only dir); sandboxed/container environments lacking access to the path.

Related errors

• {} is world writable and not sticky ({m:?})
• cannot create debug directory: {}
• --experimental-artifact is only supported on Linux
• Stopping as the directory is not empty
• Cannot pre-open the current directory twice: '--volume=.' mu

AI-assisted analysis of wasmerio/wasmer@8c4b9ee9d3 (2026-09-01). Data as JSON: /api/errors/5ecee8d55fab6140. Report an issue: GitHub.