Combo Draft: Permission & Security Troubleshooting (Permission denied / EACCES / owner mismatch)

Scenario

All 5 problem-side permission/security issues had no combo attached (coverage-matrix gap: the core 5 of 9 permission-security entries, analyzed 2026-08-29): Docker mount directory Permission denied, git repo owner mismatch, npm global install EACCES, SSH private key permissions too open, Codex sandbox write-permission/ACL errors. The common user scenario is "tools installed but permission errors on first run" — the errors all point at file permissions/owner/security settings, but the fixes live in different tool domains (container uid mapping / git safe.directory / npm prefix / private-key chmod / sandbox ACL). This combo arranges them as "locate generically first, then fix per tool"; git, ssh and drvfs were measured for real in this environment, docker and npm are honestly marked not measured due to environment limits.

Combo members

Generic locating: first distinguish "permission error" from "environment error"

Download: none (diagnostic method, not a tool)
Version: none
Install:

# Permission-error signatures: keywords Permission denied / EACCES / too open / dubious ownership;
# distinguish from "environment errors" (daemon unreachable / port conflicts, see combo-docker-wsl-env) which follow a different troubleshooting chain.
# First check the tool's own log (Codex sandbox example, Windows side):
#   C:\Users\<user>\.codex\.sandbox\sandbox.<date>.log
# Verified in this environment: C:\Users\<user>\.codex\.sandbox\ contains multiple date-stamped sandbox logs

Docker containers: uid alignment (problem: docker-volume-permission)

Download: Docker Engine/Docker Desktop (see combo-docker-wsl-env)
Version: >= 20.10 (same as combo-docker-wsl-env)
Install:

# Align the container uid to the host (recommended):
docker run -u "$(id -u):$(id -g)" -v "$PWD/data:/data" ...
# compose: user: "${UID}:${GID}" (${UID} must be exported in the shell)
# One-shot host directory owner fix:
sudo chown -R 1000:1000 ./data
# Temporary emergency (breaks least-privilege, local debugging only):
docker run -u 0:0 ...

Git: safe.directory whitelist (problem: git-dubious-ownership)

Download: none (git built-in config)
Version: git >= 2.35 (safe.directory error-reporting mechanism; measured 2.53.0 on this machine)
Install:

# Register per-directory, not recursive — other repos on the same disk need their own add:
git config --global --add safe.directory <repo-absolute-path>
# Only consider global trust when there are many repos (not recommended on shared machines):
git config --global --add safe.directory '*'
# On Linux filesystems you can change the owner directly (doesn't work on NTFS/exFAT mounts, see drvfs warning below):
sudo chown -R $(id -u):$(id -g) <repo-path>

npm: global prefix moved to the user directory (problem: npm-global-eacces)

Download: none (npm built-in config)
Version: none (any npm version; this machine node v22.22.1, npm prefix defaults to /usr/local — exactly the high-frequency EACCES default)
Install:

# Form 1 (recommended, permanent):
npm config set prefix ~/.npm-global
echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.bashrc
# Form 2: give ~/.npm ownership back to yourself:
sudo chown -R $(whoami) ~/.npm
# China network: npm global packages via npmmirror (see combo-mirror-setup):
npm config set registry https://registry.npmmirror.com

SSH: tighten private-key permissions (problem: ssh-key-permissions)

Download: none (OpenSSH built-in)
Version: none
Install:

# Linux/macOS/WSL side:
chmod 600 ~/.ssh/id_ed25519    # private key
chmod 644 ~/.ssh/*.pub         # public key
chmod 700 ~/.ssh               # directory
# Windows native OpenSSH (chmod doesn't apply):
icacls "private-key-path" /inheritance:r /grant:r "%USERNAME%:R"
# Keys on /mnt/c accessed from WSL: drvfs doesn't support chmod (measured: still 777 after chmod 600) —
# copy into WSL then chmod, or fix with icacls on the Windows side

Codex sandbox: log locating + owner/ACL fix (problem: codex-sandbox-setup-error)

Download: none (Codex built-in)
Version: none
Install:

# 1) Check the log first (faster than guessing), search for setup refresh had errors / write ACE:
#    C:\Users\<user>\.codex\.sandbox\sandbox.<date>.log (old path .codex.sandbox)
# 2) Change the owner (most common fix):
takeown /f <directory> /r /d y
# 3) Add ACL (when the owner is right but permissions are still missing):
icacls <directory> /grant <user>:(OI)(CI)F /T
# 4) Verify: reopen the session to trigger setup refresh, log errors=[] means recovered (idempotent, no reinstall)

Install order

Generic locating first: confirm it's a permission error (Permission denied/EACCES/too open/dubious ownership) rather than an environment error (daemon/port, go to combo-docker-wsl-env).
System-layer permission fixes: SSH private key and directory permissions (chmod/icacls), WSL drvfs mount special-case — these are the most universal, rule them out first.
Tool-layer per-domain fixes: git safe.directory → npm prefix → Codex sandbox ACL → Docker container uid (docker depends on a reachable daemon, last).

Dependency warnings

Conflicts: this combo's 5 fixes are independent with no shared surfaces and conflict with no plugin; complementary to combo-docker-wsl-env (environment troubleshooting) — for the same error, run the environment chain first, then the permission chain.
Versions: git safe.directory reporting needs git >= 2.35 (measured 2.53.0 here); Docker version requirement matches combo-docker-wsl-env (>= 20.10).
Environment: WSL drvfs mounts (/mnt/c) don't support chmod — measured: permission bits stay rwxrwxrwx after chmod 600, keys must be copied into WSL or fixed with icacls on the Windows side; Windows native OpenSSH uses icacls, not chmod.
China network: this combo barely involves downloads; the only download surface is npm global packages, via the npmmirror mirror (see combo-mirror-setup).

Acceptance check (one shot)

Run this block after fixing; re-run each previously failing command per domain - no permission error = domain accepted; still failing -> back to the matching step.

git -C <previously failing repo> status
npm config get prefix
ls -l ~/.ssh/id_ed25519
id  # docker group added (takes effect after reopening the terminal)

预期输出: git status OK; npm prefix points to the user dir (not /usr/local); ssh private key perms 600/400; user in the docker group. git/SSH/npm/docker domains measured; Codex sandbox domain: new session logs without errors

Note: run only the domains matching your actual error; container uid alignment uses step 5 commands (mounted dir read/write without Permission denied, measured).

Verification evidence

Every combo is measured in an isolated environment (smoke + write-surface check); unmeasured items are honestly marked in the text, and measurement dates are listed in the verification section below.

Verified 2026-08-29 · TTL expires — (180 days)

Measured 2026-08-29 (WSL Ubuntu, git 2.53.0 / node v22.22.1 / npm prefix=/usr/local):

git-dubious-ownership fully reproduced and fixed: nobody user accessing a root-owned repo reported fatal: detected dubious ownership → after safe.directory On branch master / nothing to commit ✅
ssh-key-permissions permission bits: chmod 600 effective (644 → -rw-------); drvfs counter-example: /mnt/c file still -rwxrwxrwx after chmod 600 ✅
codex-sandbox log-locating step: Windows side .codex\.sandbox\ has 3 logs (08-17/20/21), path matches the problem entry ✅
docker-volume-permission not measured: daemon unreachable on this machine (see combo-docker-wsl-env evidence log)
npm-global-eacces fix not measured (avoid polluting this machine's ~/.npmrc); read-only evidence: npm prefix defaults to /usr/local (the high-frequency EACCES default)

Evidence file: local repro log 2026-08-29

Combo Draft: Permission & Security Troubleshooting (Permission denied / EACCES / owner mismatch) Partial