{"record":{"id":"80b141513acd7725","repo":"cilium/cilium","slug":"cannot-set-default-permissions-on-socket-s-w","errorCode":null,"errorMessage":"cannot set default permissions on socket %s: %w","messagePattern":"cannot set default permissions on socket (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/monitor/agent/server.go","lineNumber":35,"sourceCode":"\n// buildServer opens a listener socket at path. It exits with logging on all\n// errors.\nfunc buildServer(logger *slog.Logger, path string) (*net.UnixListener, error) {\n\taddr, err := net.ResolveUnixAddr(\"unix\", path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot resolve unix address %s: %w\", path, err)\n\t}\n\tos.Remove(path)\n\tserver, err := net.ListenUnix(\"unix\", addr)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot listen on unix socket %s: %w\", path, err)\n\t}\n\n\tif os.Getuid() == 0 {\n\t\terr := api.SetDefaultPermissions(logger.Debug, path)\n\t\tif err != nil {\n\t\t\tserver.Close()\n\t\t\treturn nil, fmt.Errorf(\"cannot set default permissions on socket %s: %w\", path, err)\n\t\t}\n\t}\n\n\treturn server, nil\n}\n\n// server serves the Cilium monitor API on the unix domain socket\ntype server struct {\n\tlogger   *slog.Logger\n\tlistener net.Listener\n\tmonitor  Agent\n}\n\n// ServeMonitorAPI serves the Cilium 1.2 monitor API on a unix domain socket.\n// This method starts the server in the background. The server is stopped when\n// ctx is cancelled. Each incoming connection registers a new listener on\n// monitor.\nfunc ServeMonitorAPI(ctx context.Context, logger *slog.Logger, monitor Agent, queueSize int) error {","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/monitor/agent/server.go#L17-L53","documentation":"When running as root, buildServer calls api.SetDefaultPermissions to relax/group-assign the socket file so non-root clients may connect. On failure it closes the just-created listener and returns 'cannot set default permissions on socket'. The socket itself was bound fine; only the ownership/mode adjustment failed, but the server refuses to start with wrong permissions.","triggerScenarios":"Running as uid 0 and calling buildServer when chown/chmod on the socket path fails — e.g. the socket lives on a filesystem disallowing ownership changes (some bind mounts, NFS), or the target group in SetDefaultPermissions does not exist.","commonSituations":"Socket placed on an overlay/NFS mount that rejects chown, SELinux denials on attribute changes, or a hardened runtime dropping CAP_CHOWN/CAP_FOWNER so root's permission changes are refused.","solutions":["Read the wrapped error to see if it's EPERM/EOPNOTSUPP (filesystem won't allow chown/chmod) or a missing group.","Move the socket path to a local filesystem (tmpfs/ext4) that supports ownership changes.","Preserve CAP_CHOWN/CAP_FOWNER in the container securityContext if capabilities were dropped.","Adjust or allowlist SELinux/AppArmor rules permitting attribute changes on the socket path.","If permissions are managed externally (init container / systemd tmpfiles), make SetDefaultPermissions failure non-fatal by pre-creating the socket dir with correct ownership."],"exampleFix":"// before\nerr := api.SetDefaultPermissions(logger.Debug, path)\nif err != nil {\n    server.Close()\n    return nil, fmt.Errorf(\"cannot set default permissions on socket %s: %w\", path, err)\n}\n// after\nif err := api.SetDefaultPermissions(logger.Debug, path); err != nil {\n    logger.Warn(\"could not set socket permissions; relying on external setup\", logfields.Error, err)\n}","handlingStrategy":"fallback","validationCode":"if os.Getuid() == 0 {\n    // verify chown/chmod on the target path is permitted before binding\n    tmp := filepath.Join(filepath.Dir(sockPath), \".permtest\")\n    if err := os.WriteFile(tmp, nil, 0o660); err == nil {\n        err = os.Chmod(tmp, 0o660)\n        os.Remove(tmp)\n        if err != nil {\n            logger.Warn(\"socket permission changes unavailable on this fs\", \"err\", err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"server, err := buildServer(logger, path)\nif err != nil && strings.Contains(err.Error(), \"cannot set default permissions\") {\n    logger.Warn(\"socket created but permission setup failed; ensure external perms (systemd tmpfiles/init)\", \"path\", path)\n}","preventionTips":["Place the socket on a filesystem supporting chown (local fs/tmpfs, not NFS/overlay where restricted).","Preserve CAP_CHOWN/CAP_FOWNER in container securityContext when running as root.","Set up socket directory ownership via systemd tmpfiles or an init container so runtime chown isn't required.","Allowlist attribute changes in SELinux/AppArmor policy for the socket path."],"tags":["unix-socket","permissions","root","security","filesystem"],"backgroundTag":"socket-permission-denied","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}