Permissions issues on Linux — page 3
Issues the maintainers labelled both platform:linux and area:permissions.
357 issues · 81 open · 276 resolved (77%) · first seen Aug 25, 2025
Is this getting better or worse?
This class of problem is converging. 112 new reports in the last 90 days vs 177 in the 90 before — -37%. The open backlog peaked at 81 in 2026-10 and sits at 81 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
235 of these reports name the Claude Code build they were running, spanning 120 releases. Heaviest reporters:
- Claude Code v2.1.233
- Claude Code v2.1.207
- Claude Code v2.1.259
- Claude Code v2.1.119
- Claude Code v2.1.296
- Claude Code v2.1.283
- Claude Code v2.1.234
- Claude Code v2.1.114
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 30 days across 276 closures. Of the 276 closures with a recorded reason, 16% were closed as completed and 233 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
78 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] v2.1.78: Protected directory prompt in bypassPermissions has no override — forces hacky workarounds
- …t on every skill creation. 2. No override flag forces worse workarounds Since there's no setting or similar, users who need this workflow (and there are many — skills are a first-class Claude Code feature) will build wor…
Found in the description of #35646 · resolved - [BUG] Mouse click to refocus terminal triggers permission prompt unintentionally
- …ppressing the first click after the terminal regains focus. In the meantime you can set to turn off click handling while keeping wheel scroll — see 🤖 Generated with [Claude Code](
Found in the thread of #71539 · still open - [BUG] ask list is ignored when "Bash" is in allow list
- …ands) and safety (protection against destructive commands). Workarounds attempted (none work) : - - Bypasses everything including ask list - - Prompts for every new command type
Found in the description of #6527 · still open - [Bug] Permission prompt disappears after Ctrl+O toggle with concurrent tool calls
- …ly reproducible. Hit it 3+ times in a single session today. Workarounds tried - Pressing another CTRL-O + CTRL-O to see if permissions is back did not work Notes - Cache stays warm across this state, so context isn't los…
Found in the description of #60194 · resolved - [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 201–300
Ranked by community engagement (reactions weighted over comments). Listing the top 300 of 357 matches; the statistics above cover all 357.
- BPF sandbox does not propagate user command rejections as session-scoped blocklist rules
- [Bug] Excessive security warnings blocking legitimate prompts
- Auto-mode classifier blocks user-authorized deploys and compounds denials within a session
- [Bug] Claude accesses files outside specified project scope in auto mode
- [Bug] SSH authentication failing or access restrictions preventing VPS login
- [BUG] ~/.claude/settings.local.json is only applied to sessions started in $HOME — permissions and hooks silently inert elsewhere
- [Bug] Auto-mode permission classifier denies allowed operations silently with incorrect remediation guidance
- [BUG] Approving a forwarded teammate permission request with a message silently drops the message
- [Bug] Files deleted without permission confirmation in claude.md and claude-local.md
- [BUG] Skills-dir plugins don't load in subfolders of a trusted directory — every launch dir silently gets hasTrustDialogAccepted:false, no dialog ever shows (Linux, no git)
- [Bug] Unexpected file deletion without user confirmation
- [BUG] Choosing fullscreen renderer offered on tui after starting claude first removes bypassPermissions mode arguments
- [BUG] slash-command allowed-tools grants are lost when the run resumes from a task-notification
- [BUG] 2.1.211 "always allow rules save at repository root" breaks unattended runs in a linked git worktree under a worktree-scoped filesystem sandbox
- [Bug] Continuous memory access violations causing repeated flagging
- [Removed by author]
- Auto-mode classifier treats compaction interrupt text as a standing user instruction; denies post-compaction tool calls
- Feature request: auto-return to plan mode after an approved plan finishes executing
- [Bug] Excessive security alerts during normal SonarQube code review configuration
- [BUG] Explore (read-only) subagent executed rm -rf, deleting files outside its intended scope
- [BUG] Escape key can deny a confirmation while the status window is open
- [Bug][harness] SSH cert-deployment script search on own admin-managed gateway wrongly blocked as unauthorized
- [Bug][harness] SSH read-only diagnostic check on a switch's gateway blocked despite user approval to investiga
- [Bug][harness] ClAudit: auto-mode classifier denied — Editing /etc/hosts with sudo is out-of-project scope escalation — user
- [Bug][harness] Per-user enrollment packet generation blocked when writing portal login credentials for distrib
- [Bug][harness] Safety block wrongly halts adding NFS export entries to share a verified local media directory
- [Bug][harness] Blocked sed-based docker-compose.yml env var injection without offering diff preview as alterna
- [Bug][harness] ClAudit: auto-mode classifier denied — Agent is pivoting to acquiring pirated copyrighted game content (Madde
- [Bug][harness] Safety block halted cleanup of orphaned cloud-sync provisioning agent and stale updater service
- [Bug][harness] Read-only SSH enumeration of LXC containers and storage on a provisioned host wrongly blocked
- [Bug][harness] Safety block halted read-only diagnosis of a stale access-policy allowlist entry left over from
- [Bug][harness] SSH read of source/config files to debug a user-reported bug wrongly blocked as production acce
- [Bug][harness] Diagnosing WS handshake protocol skew by SSH-reading old relay binary on edge VM blocked
- [Bug][harness] auto-mode classifier blocked reading a local repo's README/CHANGELOG to plan documentation upda
- [Bug][harness] Auto mode blocks editing second GitHub issue exposing live plaintext credential during PII inci
- [Bug][harness] Auto-mode classifier blocks copying a managed TLS cert/key from one host to another to provisio
- [Bug][harness] Auto mode classifier blocks running a notification tray app that only baselines existing items
- [Bug][harness] ClAudit: auto-mode classifier denied — Modifying the production Caddyfile and restarting the live web server
- [Bug] Mobile remote control cannot dismiss stuck permission prompt without PC terminal Esc
- Subagents should inherit their worktree's cwd + permission scope across tool calls (instead of resetting to the main repo dir)
- [BUG] Subagents can no longer prompt me for permission
- [BUG] confirmation prompts preempt enter key for sending additional text
- [Bug] Agent commits changes to unauthorized project directories
- [BUG] First prompt lost in new project directory — trust prompt consumes the input, user must type it twice
- [Bug] Excessive permission requests despite previous dismissals
- Approving a plan from a remote session drops out of auto mode despite useAutoModeDuringPlan: true
- Remote-control: phone-app approval dismisses popup but never reaches local process
- [BUG] Auto-generated permission rule with a literal : inside a quoted argument is rejected on load ("The :* pattern must be at the end")
- tools: frontmatter — Read(/path), Write(/path), Glob(/path), Bash(cmd:*) parentheticals silently discarded (no runtime enforcement)
- I need a bug report to generate a GitHub issue title. Please provide details about the problem you've encountered with Claude Code, including: - What were you trying to do? - What error or unexpected behavior occurred? - Any error messages or logs?
- [Bug] Permission pattern matching fails when `:*` suffix follows another `*` wildcard
- [Bug] Spurious permission denial injected into Bash tool error output
- [Bug] Tool execution permissions suddenly denied without prompt
- Workspace-trust prompt blocks unattended `claude remote-control` under systemd on 2.1.119+
- [Feature Request] Add fallback prompt for auto-mode classifier soft-denials instead of returning denial to model
- [BUG] Claude Code violated .gitignore/.claudeignore policy by reading .env file using Bash cat command in auto-approve mode
- [BUG] Parallel tool-use batches bypass user rejection — denied calls don't cancel siblings in the same block
- [BUG] "unhandled node type $"
- Allow individual users to extend channels allowlist for third-party plugin marketplaces
- UX: defaultMode: bypassPermissions does not imply sandbox-off — easy to miss, breaks every in-project build
- Sub-agent Read/Edit denied on own worktree path despite bypassPermissions (v2.1.97)
- [Bug] Claude executes actions prematurely without awaiting user confirmation
- [Bug] Bash AST parser warning bypasses sandbox auto-approve mode
- Skill tool fails with 'Unknown skill' in dontAsk permission mode
- [BUG] Permission relay fires on all channels regardless of message origin, inconsistent with reply routing
- Agent teams: allow routing plan approvals and permission prompts to user instead of team lead
- [BUG] Claude code asking for permission to edit its own settings when bypass permissions is enabled
- Read() permission path prefix matching doesn't match files within allowed directory
- [Bug] Subfolder read permissions regression in project initialization
- Bash tool: rejected/cancelled commands still execute (process already started)
- [BUG]
- Bash tool: ZodError in permission system blocks git commands
- Terminal input regressions: permission prompt requires Enter, backspace repeat broken
- [BUG] --dangerously-skip-permissions does not bypass workspace trust prompt despite claiming to "Bypass all permission checks"
- [BUG] Wildcard permission `mcp__plugin_github_github(*)` does not match plugin MCP tools
- [BUG] Read-only Bash search denied as Self-Modification again after native /permissions retry approval
- [FEATURE] Setting to trust specific network paths (Linux /net automounts) so file reads stop prompting
- Bash safety check says "This shell -c script runs rm" for `$VAR … -- sh -c '…'` with no rm anywhere (bypass mode)
- [BUG] Self-hosted runner: resumed session comes back in plan mode although the session wrapper passes --permission-mode auto
- [Bug] Plan mode ignores MCP tool allow list permissions
- Sandbox/permission behaviour changes in patch releases aren't in the CHANGELOG — headless claude -p integrations must re-validate every update
- [Bug] Auto mode rejecting legitimate artifact edits during iterative development
- [BUG] Manual mode does not review model-generated file content written through Bash
- [Bug] /permissions whitelist not respected on tool retry
- [Bug] Sonnet model blocked from accessing blue team recon validation tool
- [BUG] Headless/agent Bash session hard-blocks all filesystem access outside primary working directory (regression — same prompt worked previously)
- [Bug] File Permission Scope Rules Inconsistent Across Sessions
- [Bug] Agent spawning restriction not enforced, causing unauthorized agent fork and excessive API usage
- Dangerous-rm approval dialog displays a target resolved against the session cwd, not the cd target
- [Bug] Authorized requests incorrectly flagged as unauthorized
- [Bug] Safety Classifier failing to block adverse content
- [Bug] Auto mode classifier generates unsafe `awk` commands with large unintended replacement radius
- [Bug] Unwanted Auto-Mode Setup Flow Triggered Without User Request
- [FEATURE]: Allow the built-in /goal Stop hook under allowManagedHooksOnly (or add a managed opt-in)
- [Bug] Claude executes irreversible external actions without explicit re-approval after context changes
- [BUG] Managed settings defaultMode is no longer respected
- [MODEL] CRITICAL PERMISSION BYPASS: Claude manufactures its own execution authority from a document it wrote, overrides an explicit in-context user prohibition, and runs unapproved privileged commands
- Safety classifier blocks benign commands with no override; recommended remedy is blocked by the same check
- [Feature Request] Add "Ask about it" option to permission prompts for clarification without rejection
- [Feature Request] Add configurable safeguard thresholds for codebase review operations