{"record":{"id":"779efd0c9d332abb","repo":"vectordotdev/vector","slug":"failed-to-set-socket-permissions-779efd","errorCode":null,"errorMessage":"Failed to set socket permissions","messagePattern":"Failed to set socket permissions","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sources/util/unix_stream.rs","lineNumber":63,"sourceCode":"    out: SourceSender,\n) -> crate::Result<Source>\nwhere\n    D: tokio_util::codec::Decoder<Item = (F, usize), Error = E> + Clone + Send + 'static,\n    E: StreamDecodingError + std::fmt::Display + Send + From<std::io::Error>,\n    F: Into<SmallVec<[Event; 1]>> + Send,\n{\n    Ok(Box::pin(async move {\n        let listener = UnixListener::bind(&listen_path).unwrap_or_else(|e| {\n            panic!(\n                \"Failed to bind to listener socket at path: {}. Err: {}\",\n                listen_path.to_string_lossy(),\n                e\n            )\n        });\n        info!(message = \"Listening.\", path = ?listen_path, r#type = \"unix\");\n\n        change_socket_permissions(&listen_path, socket_file_mode)\n            .expect(\"Failed to set socket permissions\");\n\n        let bytes_received = register!(BytesReceived::from(Protocol::UNIX));\n\n        let connection_open = OpenGauge::new();\n        let stream = UnixListenerStream::new(listener).take_until(shutdown.clone());\n        tokio::pin!(stream);\n        while let Some(socket) = stream.next().await {\n            let socket = match socket {\n                Err(error) => {\n                    error!(message = \"Failed to accept socket.\", %error);\n                    continue;\n                }\n                Ok(socket) => socket,\n            };\n\n            let listen_path = listen_path.clone();\n\n            let span = info_span!(\"connection\");","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/src/sources/util/unix_stream.rs#L45-L81","documentation":"The unix stream source binds an `UnixListener` successfully, then applies the configured `socket_file_mode` with `change_socket_permissions`; this `expect(\"Failed to set socket permissions\")` (src/sources/util/unix_stream.rs:63) panics when the chmod fails. As with the datagram variant, the helper no-ops when `socket_file_mode` is None, so the panic requires an explicitly configured mode plus an OS-level chmod failure (LSM/SELinux denial, read-only filesystem, or the socket file disappearing before chmod).","triggerScenarios":"unix socket (stream) source — e.g. socket-vector source or custom unix stream inputs — with `socket_file_mode` configured, running under an LSM that denies set_permissions, on a read-only fs, or with an external actor removing the socket file immediately after bind.","commonSituations":"SELinux enforcing on RHEL/CentOS nodes denying chmod on the socket; containers with read-only rootfs; misconfigured socket_file_mode values applied on paths managed by systemd-tmpfiles with restrictive policies.","solutions":["Check audit logs for set_permissions denials on the socket path and grant the exception or fix the file context","Place socket_path on a writable directory owned by the Vector process","Remove `socket_file_mode` from the config so the permission step is skipped","Verify nothing (tmpfiles cleaner, security agent) removes the socket between bind and chmod"],"exampleFix":"# before\nsources:\n  vector_metrics:\n    type: socket\n    mode: unix\n    path: /var/run/vector/stream.sock\n    socket_file_mode: 511\n# after\nsources:\n  vector_metrics:\n    type: socket\n    mode: unix\n    path: /var/run/vector/stream.sock\n    # socket_file_mode removed","handlingStrategy":"validation","validationCode":"# shell: verify the process may chmod in the target directory\ntouch /var/run/vector/.permtest && chmod 511 /var/run/vector/.permtest && rm /var/run/vector/.permtest\ngetenforce 2>/dev/null || true","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit socket_file_mode unless a specific integration requires custom socket permissions","Grant the Vector service account chmod rights on its runtime directory in LSM policy","Keep the socket directory free of tmpfiles/cleanup jobs that race the source startup"],"tags":["unix-socket","stream","chmod","permissions","panic"],"backgroundTag":"chmod-failed","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}