{"record":{"id":"31ed3db885e0361e","repo":"netbirdio/netbird","slug":"failed-setting-s-permissions-for-s-w","errorCode":null,"errorMessage":"failed setting %s permissions for %s: %w","messagePattern":"failed setting (.+?) permissions for (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/service_socket.go","lineNumber":116,"sourceCode":"\n\treturn errors.Is(err, syscall.ECONNREFUSED)\n}\n\nfunc removeStaleUnixSocketForAddress(addr string) {\n\tnetwork, address, err := parseListenAddress(addr)\n\tif err != nil || network != \"unix\" {\n\t\treturn\n\t}\n\tremoveStaleUnixSocket(address)\n}\n\nfunc (l *socketListener) chmodUnixSocket(description string) error {\n\tif l == nil || l.network != \"unix\" {\n\t\treturn nil\n\t}\n\n\tif err := os.Chmod(l.address, 0666); err != nil {\n\t\treturn fmt.Errorf(\"failed setting %s permissions for %s: %w\", description, l.address, err)\n\t}\n\treturn nil\n}\n","sourceCodeStart":98,"sourceCodeEnd":120,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/service_socket.go#L98-L120","documentation":"After binding a unix socket, the daemon chmods it to 0666 so unprivileged CLI/UI callers can connect; that chmod failed. The message names which listener it was setting permissions for and the socket path, wrapping the OS error.","triggerScenarios":"The socket file disappears between listen and chmod (a concurrent instance running stale-socket cleanup); the daemon runs as a user that cannot chmod the path; SELinux/AppArmor denies chmod; a filesystem that rejects mode changes.","commonSituations":"Two daemons racing on the same --daemon-addr; hardened or containerized hosts with mandatory access control.","solutions":["Ensure a single daemon instance per socket path","Run the service as root (default) or grant ownership of the socket directory to the daemon user","Check SELinux/AppArmor audit logs for denials on the socket path","Move the socket under a standard writable path such as /var/run"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"if fi, err := os.Stat(filepath.Dir(socketPath)); err != nil || !fi.IsDir() {\n\treturn fmt.Errorf(\"socket directory %s unusable\", filepath.Dir(socketPath))\n}","typeGuard":null,"tryCatchPattern":"if err := l.chmodUnixSocket(\"daemon\"); err != nil {\n\t// the listener is already bound; keep serving and warn rather than fail\n\tlog.Warnf(\"clients may be unable to connect: %v\", err)\n}","preventionTips":["Run exactly one daemon per socket path","Run the service as root or own the socket directory","Watch LSM audit logs when hardening hosts running NetBird"],"tags":["daemon","unix-socket","file-permissions","go"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}