{"record":{"id":"66b793febb38b75f","repo":"joewalnes/websocketd","slug":"socketmode-q-has-bits-beyond-permission-bits-k","errorCode":null,"errorMessage":"--socketmode %q has bits beyond permission bits (keep it within 0777)","messagePattern":"--socketmode %q has bits beyond permission bits \\(keep it within 0777\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config.go","lineNumber":93,"sourceCode":"\t\t}\n\t}\n\treturn out\n}\n\n// parseSocketMode parses the --socketmode flag: an octal permission mode\n// such as \"0700\". The empty string means \"not set\" and leaves the socket\n// file to the process umask; an explicit zero is rejected because it would\n// make the socket unusable for everyone, owner included.\nfunc parseSocketMode(s string) (os.FileMode, error) {\n\tif s == \"\" {\n\t\treturn 0, nil\n\t}\n\tmode, err := strconv.ParseUint(s, 8, 32)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"--socketmode %q is not an octal permission mode (e.g. 0700)\", s)\n\t}\n\tif mode > 0o777 {\n\t\treturn 0, fmt.Errorf(\"--socketmode %q has bits beyond permission bits (keep it within 0777)\", s)\n\t}\n\tif mode == 0 {\n\t\treturn 0, fmt.Errorf(\"--socketmode 0 would make the socket unusable; pick a mode like 0700\")\n\t}\n\treturn os.FileMode(mode), nil\n}\n\n// resolveAddresses builds the list of TCP addresses to listen on.\nfunc resolveAddresses(addrlist []string, port int) []string {\n\tif len(addrlist) > 0 {\n\t\taddrs := make([]string, len(addrlist))\n\t\tfor i, addr := range addrlist {\n\t\t\taddrs[i] = fmt.Sprintf(\"%s:%d\", addr, port)\n\t\t}\n\t\treturn addrs\n\t}\n\treturn []string{fmt.Sprintf(\":%d\", port)}\n}","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/joewalnes/websocketd/blob/7a8683dc7f9778dc615945aaed2a8dc77290227b/config.go#L75-L111","documentation":"parseSocketMode rejects --socketmode values that parse as octal but contain bits outside the 0777 permission range (e.g. setuid/setgid/sticky or higher bits). The flag is restricted to plain permission bits.","triggerScenarios":"Running websocketd with --socketmode=4755 (setuid bit) or 1777 (sticky bit) or any octal value greater than 0o777.","commonSituations":"Operators copying modes intended for executables (setuid 4755) onto a Unix socket; trying to set sticky bits expecting they apply to sockets.","solutions":["Drop extra bits and use a value within 0777, e.g. 0770 for group-writable sockets","Rely on directory permissions or group membership to control socket access instead"],"exampleFix":"// before\nwebsocketd --socketmode=4755 --ssl --port=443 ./script.sh\n// after\nwebsocketd --socketmode=0755 --ssl --port=443 ./script.sh","handlingStrategy":"validation","validationCode":"const mode = parseInt(socketMode, 8);\nif (mode > 0o777) throw new Error('socketmode must be within 0777');","typeGuard":null,"tryCatchPattern":"if err := parseSocketMode(v); err != nil { log.Warn(err); mode = 0700 }","preventionTips":["Strip setuid/setgid/sticky bits from any mode you copy (4755 -> 0755)","Remember this flag is a plain permission mask, not a chmod on an executable"],"tags":["cli","config-validation","unix-permissions"],"backgroundTag":"invalid-octal-mode","analyzedSha":"7a8683dc7f9778dc615945aaed2a8dc77290227b","analyzedAt":"2026-09-03T13:52:22.309Z","contentChangedAt":"2026-09-03T13:52:22.309Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}