checkPermission

checkPermission(stat, euid, egid, access): void

Defined in: packages/core/src/kernel/lib/permissions.ts:62

Check POSIX permission bits against effective uid/gid and requested access.

Parameters

stat

Stat

Target file metadata; mode, uid, gid are consulted.

euid

Uid

Effective user id of the calling process.

egid

Gid

Effective group id of the calling process.

access

"r" | "w" | "x"

'r' (read), 'w' (write), or 'x' (execute).

Returns

void

Nothing when allowed.

Remarks

Resolves the owner/group/other triple the usual way: owner bits apply when euid matches stat.uid, group bits when egid matches stat.gid, otherwise other bits. Missing mode defaults to 0o644 (so execute on an unspecified-mode file always denies for non-root). Missing uid/gid default to 0.

Root (euid === 0) bypasses read and write checks unconditionally. For execute, root still requires at least one 0o111 bit to be set — matching Linux semantics so chmod 0644 /bin/foo && su cannot run foo.

The kernel invokes this from open-time access checks in kernel/proc/resolve.ts (for r/w) and from bin lookup in kernel/proc/resolve-bin.ts (for x). Fileservers with their own checkAccess capability short-circuit this helper.

Throws

FsError (EACCES) when the requested bit is not set for the resolved triple (or, for root execute, when no execute bit is set).

Example

import { checkPermission, uid, gid, FsError } from '@fishnet/core'

try {
  checkPermission(
    { name: 'secret', size: 0, type: 'file', mtime: 0, mode: 0o600, uid: 0, gid: 0 },
    uid(1000), gid(1000), 'r',
  )
} catch (err) {
  if (FsError.is(err) && err.code === 'EACCES') {
    // denied
  }
}

See

• FsError
• Fileserver