{"record":{"id":"819aca10ce6074b6","repo":"zeroclaw-labs/zeroclaw","slug":"local-ipc-endpoint-lock-is-accessible-to-other","errorCode":null,"errorMessage":"local IPC endpoint lock {} is accessible to other users (mode {:o}); restrict it to 0600 or remove it","messagePattern":"local IPC endpoint lock (.+?) is accessible to other users \\(mode (.+?)\\); restrict it to 0600 or remove it","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-runtime/src/rpc/local.rs","lineNumber":342,"sourceCode":"    fn require_trusted_lock_file(metadata: &Metadata, lock_path: &Path) -> Result<()> {\n        if !metadata.file_type().is_file() {\n            anyhow::bail!(\n                \"local IPC endpoint lock {} is not a regular file; remove it \\\n                 or choose a different socket path\",\n                lock_path.display()\n            );\n        }\n        let euid = unsafe { libc::geteuid() };\n        if metadata.uid() != euid {\n            anyhow::bail!(\n                \"local IPC endpoint lock {} is owned by uid {}, not the \\\n                 daemon user; remove it or choose a different socket path\",\n                lock_path.display(),\n                metadata.uid()\n            );\n        }\n        if metadata.mode() & 0o077 != 0 {\n            anyhow::bail!(\n                \"local IPC endpoint lock {} is accessible to other users \\\n                 (mode {:o}); restrict it to 0600 or remove it\",\n                lock_path.display(),\n                metadata.mode() & 0o7777\n            );\n        }\n        if metadata.nlink() == 0 {\n            anyhow::bail!(\n                \"local IPC endpoint lock {} was unlinked while being opened\",\n                lock_path.display()\n            );\n        }\n        Ok(())\n    }\n\n    impl EndpointLock {\n        pub(super) fn acquire(path: &Path) -> Result<Self> {\n            let mut lock_name = path.as_os_str().to_os_string();","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/rpc/local.rs#L324-L360","documentation":"The existing lock file `<socket>.lock` has group or other access bits set (mode & 0o077 != 0). The lock must be 0600: a permissive lock lets other local users read/tamper with endpoint lifecycle state or interfere with the lock protocol, so acquisition fails closed.","triggerScenarios":"An earlier process created the lock under a permissive umask or someone chmod'ed it wider; a config-management tool normalized permissions on the runtime dir to 0644; the lock was copied/restored with relaxed modes.","commonSituations":"'chmod -R a+r' style fixes on state directories; umask 000 in legacy init scripts; packaging that pre-creates the lock with 0644; security scanners flagging the file and an admin loosening instead of tightening other files nearby.","solutions":["Tighten it: chmod 600 <socket>.lock.","Or remove it (rm <socket>.lock) and let the daemon recreate it with 0600.","Fix the umask of the creating process (the daemon requests mode 0o600, but pre-existing files are taken as-is).","Check config management/ACL tooling that keeps re-widening the mode."],"exampleFix":"# before\nls -l /run/zeroclaw/zeroclaw.sock.lock   # -rw-r--r-- 1 zeroclaw zeroclaw ...\n\n# after\nchmod 600 /run/zeroclaw/zeroclaw.sock.lock\n# or: rm /run/zeroclaw/zeroclaw.sock.lock && systemctl restart zeroclaw","handlingStrategy":"validation","validationCode":"use std::os::unix::fs::PermissionsExt;\nfn lock_mode_private(sock: &std::path::Path) -> bool {\n    let mut s = sock.as_os_str().to_os_string();\n    s.push(\".lock\");\n    std::fs::symlink_metadata(std::path::PathBuf::from(s))\n        .map(|m| m.permissions().mode() & 0o077 == 0)\n        .unwrap_or(true)\n}","typeGuard":null,"tryCatchPattern":"if !lock_mode_private(&sock_path) {\n    anyhow::bail!(\"lock mode too permissive; chmod 600 <socket>.lock\");\n}","preventionTips":["Avoid blanket chmod -R on state directories.","Set a restrictive umask (0022 or tighter) in the service unit.","Include lock-file mode in security baseline scans."],"tags":["unix","permissions","ipc","lock-file","security","startup"],"backgroundTag":"insecure-file-permissions","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}