Permissions issues on Linux — page 2
Issues the maintainers labelled both platform:linux and area:permissions.
357 issues · 81 open · 276 resolved (77%) · first seen Aug 25, 2025
Is this getting better or worse?
This class of problem is converging. 112 new reports in the last 90 days vs 177 in the 90 before — -37%. The open backlog peaked at 81 in 2026-10 and sits at 81 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
235 of these reports name the Claude Code build they were running, spanning 120 releases. Heaviest reporters:
- Claude Code v2.1.233
- Claude Code v2.1.207
- Claude Code v2.1.259
- Claude Code v2.1.119
- Claude Code v2.1.296
- Claude Code v2.1.283
- Claude Code v2.1.234
- Claude Code v2.1.114
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 30 days across 276 closures. Of the 276 closures with a recorded reason, 16% were closed as completed and 233 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
78 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] v2.1.78: Protected directory prompt in bypassPermissions has no override — forces hacky workarounds
- …t on every skill creation. 2. No override flag forces worse workarounds Since there's no setting or similar, users who need this workflow (and there are many — skills are a first-class Claude Code feature) will build wor…
Found in the description of #35646 · resolved - [BUG] Mouse click to refocus terminal triggers permission prompt unintentionally
- …ppressing the first click after the terminal regains focus. In the meantime you can set to turn off click handling while keeping wheel scroll — see 🤖 Generated with [Claude Code](
Found in the thread of #71539 · still open - [BUG] ask list is ignored when "Bash" is in allow list
- …ands) and safety (protection against destructive commands). Workarounds attempted (none work) : - - Bypasses everything including ask list - - Prompts for every new command type
Found in the description of #6527 · still open - [Bug] Permission prompt disappears after Ctrl+O toggle with concurrent tool calls
- …ly reproducible. Hit it 3+ times in a single session today. Workarounds tried - Pressing another CTRL-O + CTRL-O to see if permissions is back did not work Notes - Cache stays warm across this state, so context isn't los…
Found in the description of #60194 · resolved - [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 357 matches; the statistics above cover all 357.
- [Bug][harness] Safety block halts read-only firewall/bind-config audit, misreading nft install and listen-addr
- [Bug][harness] Adding a GPP printer mapping with SID-targeting to a GPO blocked as production-wide push
- [Bug][harness] ClAudit: auto-mode classifier denied — Starting LIVE real-money trading bot ([REDACTED]_DRY_RUN=0) on the new CT
- [Bug][harness] Trusting Caddy-generated local-CA root certs on workstation blocked, halting internal-TLS FQDN-
- [Bug][harness] Reading cloudflared/Caddy config files over an authorized SSH session wrongly blocked as unauth
- [Bug][harness] Safety filter blocks bulk cleanup of already-imported completed torrents using authoritative im
- [Bug][harness] Safety block halted authorized qBittorrent cleanup of torrents already verified copied to media
- [Bug][harness] SSH read of remote user's home dir and systemd config soft-blocked mid-investigation with no in
- [Bug][harness] Removing auth gate during debug blocked without seeking clarification on scope
- [Bug][harness] Auto-classifier blocks batch GitHub issue update loop mid-run with no recourse
- [Bug][harness] Read-only firewall rule investigation wrongly blocked as autonomous DB write escalation
- [Bug][harness] ClAudit: auto-mode classifier denied — The user said Keith "is no longer with the company" as context, not as
- [Bug][harness] Safety block halted deploying no-proxy server binary to onboard a user on a separate production
- [Bug][harness] ClAudit: auto-mode classifier denied — Mass deletion of user/wallet/operator data and seeding a different use
- [Bug][harness] Safety block halts Azure AD Cloud Sync repair by refusing required Directory Sync Accounts role
- [Bug][harness] Safety block halts authorized admin SSH+credential read into container to recover locked-out En
- [Bug][harness] Safety block halts authorized stale directory device-object cleanup during hardening sweep
- [Bug][harness] Pushing approved recon-agent binary/service update to online production hosts wrongly blocked a
- [Bug][harness] Code-reading-only RBAC audit blocked by remote-write guard misclassifying it as a live OWNER gr
- [Bug][harness] Safety block stopped authorized bugfix deploy after user said "send it", forcing manual server
- [Bug][harness] ClAudit: auto-mode classifier denied — Creating an Azure AD app registration with admin-consented application
- [Bug][harness] ClAudit: auto-mode classifier denied — Real credentials (`WINRM_PASS = "zWSae6qapLgUi3eVh6QMulQ7PBKf"`) are h
- [Bug][harness] ClAudit: auto-mode classifier denied — The action reads the MSAL token cache to extract a user refresh token
- [Bug][harness] Dev server LAN rebind for local-only preview wrongly blocked as unrequested network exposure
- [Bug][harness] Cross-host VM disk move triggered for out-of-scope VM during single-VM storage migration
- [Bug][harness] ClAudit: auto-mode classifier denied — Real-World Transaction: sending crypto payment from Coinbase to a dest
- [Bug][harness] ClAudit: auto-mode classifier denied — Greps the production secrets.env on morel to hunt for a BscScan API ke
- [Bug][harness] ClAudit: auto-mode classifier denied — Real-money Coinbase BNB send with a destination address resolved from
- [Bug][harness] ClAudit: auto-mode classifier denied — Real-money Coinbase send to a destination address the agent pulled fro
- [Bug][harness] Build & deploy wakelock PWA frontend feature blocked at restart step after clean local build
- [Bug][harness] ClAudit: auto-mode classifier denied — The agent is systematically scanning credential stores across multiple
- [Bug][harness] Safety block stops in-place edit of prod service's runtime config thresholds despite authorizat
- [Bug][harness] Auto mode blocks reading an SSH password from a controller API field to log into an authorized
- [Bug][harness] Read-only SSH to read reverse-proxy config and service status blocked as unapproved prod write
- [Bug][harness] ClAudit: auto-mode classifier denied — Running build-agent.sh extracts codesign/relay signing credentials and
- [Bug][harness] Auto mode classifier blocks routine sync of a stale local clone to its remote tracking branch
- [Bug][harness] auto-mode classifier wrongly denied running a routine shell script, blocking legitimate task ex
- [Bug][harness] Auto-mode classifier blocks reading .env files to triage authorized email-account compromise in
- [Bug][harness] Auto mode classifier blocks adding a fraud lookalike domain to shared DNS denylist during activ
- [Bug][harness] Auto-mode classifier blocks reading own service's config over SSH during deploy debugging, halt
- [Bug][harness] Reading image-gen API key env vars to fall back to alternate provider after primary key rejecte
- [Bug][harness] ClAudit: auto-mode classifier denied — Executes commands inside the live client domain controller via raw `qm
- [Bug][harness] ClAudit: auto-mode classifier denied — Creates an agent-chosen external GitHub repo and posts real issues/com
- [Bug][harness] ClAudit: auto-mode classifier denied — nmap-based scouting of router/management interfaces is shared-infra pr
- [Bug][harness] ClAudit: auto-mode classifier denied — Reading another project's Cloudflare API token from disk and querying
- [Bug][harness] ClAudit: auto-mode classifier denied
- [BUG] VSCode extension: 'Always allow' permission option truncates command text
- [Bug] Unauthorized autonomous merge with admin override bypassed branch protection
- Remote-control: "Allow for session" permission response locks up the session
- Compound-command detector flags read-only `cd && <cmd>` patterns, blocking common workflows
- [BUG] claude code writes memory without asking for permission
- [BUG] "Human:" messages cause Permission Mode: Auto to allow unauthorized tasks
- [Bug] Auto Mode not available in permission mode cycle despite Max plan eligibility
- [BUG] Claude is calling bash commands that are prohibited.
- [BUG] Claude continually asks for permission, even after selecting yes, always allow.
- [Bug] Remote Control session approval dropped, agent wedges indefinitely
- [Bug] File operations execute with Accept Edits disabled
- [BUG] Claude conflates planning permission with execution permission
- [BUG] CLI binary spawns subprocesses (e.g. gh) outside the permission model — invisible to allowlist audits
- [Bug] Local directory permissions get copied into global settings.json on config update
- bypassPermissions on agents ignores settings.local.json allowlist
- Read/Glob/Grep allowed in global settings but still prompts in git worktrees
- [BUG] Tool permission denial not enforced — WebFetch executed after user selected "No"
- [MODEL] Sonnet 4.5 Generates bash non Claude format wildcard glob patterns into settings.json
- [BUG] AskUserQuestion silently skipped when explicitly listed in skill's allowed-tools
- [Bug] Auto-accept disabled but destructive database deletion executed without confirmation
- [Bug] Remote Control: PreTooluse hook auto-allowed permissions still prompt for confirmation
- managed-settings.json: deny Read(**) does not block reads outside allowed paths
- Auto mode classifier blocks read-only browser page reads during a user-authorized read-only task
- [Bug] Auto mode classifier interferes with user workflows
- [BUG] In strict sandbox mode, non-literal paths force permission prompts even in Auto mode
- [BUG]
- permissions.deny Read rules cannot fence the project auto-memory directory (~/.claude/projects/<cwd-slug>/memory/*)
- [BUG] `claude rc` on the home directory: accepting the trust dialog never persists (`hasTrustDialogAccepted` stays false), trust loops forever
- [BUG] Regression in 2.1.207: automount -hosts check forces a permission prompt on every Read inside the working directory when $HOME is under /net/<host>/ (autofs)
- Plan mode not enforced: Write/Edit/Bash mutations execute without prompts while plan-mode reminders active (2.1.183, cli entrypoint); spurious "Exited Plan Mode" events without user approval
- [BUG] There is no indication to the user when Claude sets `dangerouslyDisableSandbox: true`
- [Bug][harness] Skill-based file transfer and service restart deployment to a fleet container wrongly blocked a
- [Bug][harness] Classifier blocks adding refusal-text filter to auto-posted issue body pipeline
- [Bug][harness] ClAudit: auto-mode classifier denied — Editing the [REDACTED] skill at the user's prompt to refram
- [Bug][harness] Diagnosing a two-level subdomain SSL/cert error was wrongly blocked as an unauthorized producti
- [BUG] Remote VM session: tool call in flight at laptop sleep phantom-denies after exactly 600s — "user doesn't want to take this action" + toolUseResult "Error: undefined", despite bypassPermissions
- ...
- [BUG] Symlink paths don't match permission patterns, causing repeated prompts
- [BUG] `/permissions` reports success when adding new Allow rules and writeable workspace dirs that managed policy forbids (misleading UI, not enforced; no privilege escalation)
- [Bug] Claude ignores user instructions and executes without approval despite repeated prompting
- [BUG] Plan-mode read-only guarantee is bypassed by spawned subagents — auto mode classifier governs subagents instead of plan mode.
- [BUG] --dangerously-skip-permissions ignored when SSH_CONNECTION is set or TERM is empty
- No path to full autonomy when running as root (uid=0)
- Remote Control: approving permission from phone hangs Claude Code on host
- Mobile "Code" controller permission approval hangs local CLI TUI with in-progress tool call
- [BUG] Claude code crashes sometimes when requesting permission to edit a file
- [BUG] Bash(cmd *) allowlist silently bypassed for commands interpolating user env vars; uninformative denial
- [Bug] Auto mode allows deletion of critical system directories without safety validation
- permissions.skipDangerousModePermissionPrompt ignored in user settings (v2.1.109)
- Subagents with bypassPermissions ignore PreToolUse hooks — unauthorized commands, wasted tokens
- [BUG] Background subagent tool calls silently denied — permission dialog never surfaced
- Ralph Loop plugin: shell permission checker rejects --flags as 'multiple operations'
- --dangerously-skip-permissions does not bypass Bash permission prompts (2.1.80)
- Self-modification permission prompt lacks context, undermines security through habituation