Error mkdir setting up /opt

[plengauer]

I have this workflow run where i get this error:

Copying activation files to /opt/gh-aw/actions
Safe-output-projects support: false
mkdir: cannot create directory ‘/opt/gh-aw’: Permission denied

I think it stems from me preinstalling some packages on the runner that also installs files in /opt. I think the code here https://github.com/github/gh-aw/blob/main/actions/setup/setup.sh makes a wrong assumption, namely that /opt is not root owned on Linux.

Running ls /opt on ubuntu-latest runner or just an ubuntu:latest docker image, always shows /opt being root owned.

[plengauer]

on further examination, i found that even after install of my package, the /opt directory seems to be, although root owned, writable by all: drwxrwxrwx+ 14 root root

[pelikhan]

/scout investigate failure

[github-actions]

🔍 Scout Research Report

Triggered by @pelikhan

Executive Summary

The failure is a confirmed bug in actions/setup/setup.sh: the create_dir() helper uses sudo only on macOS, but silently assumes /opt is writable on Linux. When a pre-install step modifies /opt's ACL (Access Control List), mkdir -p /opt/gh-aw fails with "Permission denied" even though ls shows drwxrwxrwx+.

Detailed Findings

Root Cause: create_dir() Linux Path Has No sudo

In actions/setup/setup.sh, the helper is:

create_dir() {
  if [[ "$(uname -s)" == "Darwin" ]]; then
    sudo mkdir -p "$1"
    sudo chown -R "$(whoami)" "$1"
  else
    mkdir -p "$1"   # <-- no sudo on Linux
  fi
}

The macOS branch correctly uses sudo because /opt is root-owned there. The Linux branch assumes the runner always has write access to /opt, which is not guaranteed.

Why drwxrwxrwx+ Still Denies Access

The + suffix in the permissions string signals a POSIX ACL is present on the directory. With POSIX ACLs, the traditional permission bits are insufficient to determine actual access:

1. When an ACL is present, the group bits in ls -l output represent the ACL mask (the effective permission ceiling for group-class entries), NOT the actual group permissions.
2. An explicit ACL deny entry for a specific user/group overrides the permissive-looking rwx bits.
3. A package that installs into /opt may apply setfacl rules (e.g., restricting the directory to specific groups), and the apparent rwxrwxrwx+ can still result in EACCES for the runner user.

This is a well-known Linux ACL gotcha — see [Red Hat KB: User still getting "Permission denied" after ACL added]((access.redhat.com/redacted)

The Scenario

1. User's workflow pre-installs a package → package writes files/dirs into /opt, possibly applying setfacl rules that restrict write access.
2. gh-aw setup action runs → mkdir -p /opt/gh-aw fails because the runner user is now blocked by the ACL.
3. On a clean runner (no pre-installs), /opt is world-writable (drwxrwxrwx without +), so mkdir succeeds without sudo.

Workaround Available Now

As noted in the issue, GitHub-hosted ubuntu-latest runners grant passwordless sudo to the runner user. A pre-step in the user's workflow can fix the permissions before calling the setup action:

- name: Fix /opt permissions
  run: sudo mkdir -p /opt/gh-aw && sudo chown -R $USER /opt/gh-aw

Recommendations

1. Fix create_dir() for Linux — apply the same sudo mkdir -p + sudo chown pattern used on macOS when plain mkdir fails:

   create_dir() {
     if ! mkdir -p "$1" 2>/dev/null; then
       sudo mkdir -p "$1"
       sudo chown -R "$(whoami)" "$1"
     fi
   }

   A try-first approach avoids breaking self-hosted runners where sudo may not be available, while gracefully handling privilege-restricted environments.

2. Document the /opt assumption — add a note in the action docs that pre-install steps modifying /opt ACLs may require a permission fix step, or that users can override the destination via INPUT_DESTINATION.

3. Consider an alternative default destination — using $RUNNER_TEMP/gh-aw/actions (always writable) as the default instead of /opt/gh-aw/actions would eliminate this class of issue entirely on GitHub-hosted runners. The INPUT_DESTINATION override already exists for customization.

References:

• §22396143656

🔭 Intelligence gathered by Scout