# Elastic Agent (IronBank) Components: Missing Executable Permissions on GO CLI Binaries
**URL:** https://discuss.elastic.co/t/elastic-agent-ironbank-components-missing-executable-permissions-on-go-cli-binaries/358997
**Category:** Elastic Agent
**Created:** [May 7, 2024, 10:21pm UTC](https://discuss.elastic.co/t/elastic-agent-ironbank-components-missing-executable-permissions-on-go-cli-binaries/358997 "2024-05-07T22:21:55Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@zedtran](https://discuss.elastic.co/u/zedtran)
#### Post date: [May 7, 2024, 10:21pm UTC](https://discuss.elastic.co/t/elastic-agent-ironbank-components-missing-executable-permissions-on-go-cli-binaries/358997/1 "2024-05-07T22:21:55Z")
The following files are missing the executable permission in the resulting Elastic Agent image stored in the IronBank container registry (File Type: `ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, Go BuildID=*, stripped`):
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/pf-host-agent
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/auditbeat
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/osqueryd
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/fleet-server
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/filebeat
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/metricbeat
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/cloudbeat
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/heartbeat
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/osquerybeat
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/pf-elastic-symbolizer
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/apm-server
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/pf-elastic-collector
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/cloud-defend
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/endpoint-security
- /usr/share/elastic-agent/data/elastic-agent-xxxxxx/components/packetbeat
They (and potentially others like `elastic-agent-shipper`, depending on version) can be identified via the following `find` command:
```auto
find /usr/share/elastic-agent/data/elastic-agent-*/components -maxdepth 1 -type f -not -name "*.*"
```
[`coordinator.go` \> GO `func lobBasedOnState(...)`](https://github.com/elastic/elastic-agent/blob/main/internal/pkg/agent/application/coordinator/coordinator.go#L1562) produces error logging at [elastic-agent/internal/pkg/agent/application/coordinator/coordinator.go at main · elastic/elastic-agent · GitHub](https://github.com/elastic/elastic-agent/blob/main/internal/pkg/agent/application/coordinator/coordinator.go#L608) and [elastic-agent/internal/pkg/agent/application/coordinator/coordinator.go at main · elastic/elastic-agent · GitHub](https://github.com/elastic/elastic-agent/blob/main/internal/pkg/agent/application/coordinator/coordinator.go#L615), respectively. A sample output of the log error message for package `fleet_server` is below (stack version 8.12.1):
```json
{"log.level":"error","@timestamp":"2024-05-03T21:24:38.797Z","log.origin":{"file.name":"coordinator/coordinator.go","file.line":563},"message":"Spawned new component fleet-server-default: Failed: execution of component prevented: cannot be writeable by group or other","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"FAILED"},"ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-05-03T21:24:38.797Z","log.origin":{"file.name":"coordinator/coordinator.go","file.line":570},"message":"Spawned new unit fleet-server-default-fleet-server: Failed: execution of component prevented: cannot be writeable by group or other","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"FAILED"},"unit":{"id":"fleet-server-default-fleet-server","type":"input","state":"FAILED"},"ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-05-03T21:24:38.797Z","log.origin":{"file.name":"coordinator/coordinator.go","file.line":570},"message":"Spawned new unit fleet-server-default: Failed: execution of component prevented: cannot be writeable by group or other","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"FAILED"},"unit":{"id":"fleet-server-default","type":"output","state":"FAILED"},"ecs.version":"1.6.0"}
```
I believe the following `find` commands in the Dockerfile `RUN` directive for Elastic Agent permissions (Build Stage 0) ([source](https://github.com/elastic/elastic-agent/blob/52be25317601f5c36248b3ec316e336387c54c11/dev-tools/packaging/templates/ironbank/Dockerfile.tmpl#L78C1-L80C74)) have permissions for files and directories in reverse order.
```bash
find /usr/share//elastic-agent/data -type d -exec chmod 0770 {} \; <=== Propose changing octals to something like '0660' or '0664'
find /usr/share//elastic-agent/data -type f -exec chmod 0660 {} \; <=== Propose changing octals to something like '0750' or '0755'
```
---
### Author:  [@zedtran](https://discuss.elastic.co/u/zedtran)
#### Post date: [May 8, 2024, 9:08pm UTC](https://discuss.elastic.co/t/elastic-agent-ironbank-components-missing-executable-permissions-on-go-cli-binaries/358997/2 "2024-05-08T21:08:00Z")
Appears this is being handled by elastic-agent [issue #4539](https://github.com/elastic/elastic-agent/issues/4539).