whycant

Output is now serialized to json, toml, and plain from one schema, color and clickable paths work across terminals, and an interactive picker applies the least-privilege fix from its argv then re-checks that the block cleared.

So far I’ve gotten the following implemented:

• file traversal
• DAC/ACLs/attrs
• mounts
• MAC/LSM
• capabilities
• network-FS
• container userns
• macOS SIP/quarantine/TCC

So overall a good chunk of the project is done, the main functionality to figure out why you can’t do an FS operation is finished, I need to polish it for docs, better modern terminal emulator support (exit codes, copy pasting, titles, etc.), publish to crates or something and so on.

Also I tried my best to make it library/compiler agnostic for per-platform usage :)

I implemented ACL support, also with support to check against a specific --user. This covers a good range of permission issues, parent directory traversal, DAC modes, POSIX-compliant ACLs (under its mask), immutable attributes, noexec, etc. We check with faccessat as well, and print all the flagged items/exit with a relevant exit code, so all that infrastructure is ready as well.