{"record":{"id":"9784223f9252eb9a","repo":"kataras/iris","slug":"cannot-chmod-o-for-q-w","errorCode":null,"errorMessage":"cannot chmod %#o for %q: %w","messagePattern":"cannot chmod %#o for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/netutil/tcp.go","lineNumber":80,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn tcpKeepAliveListener{ln.(*net.TCPListener), keepAliveDur}, nil\n}\n\n// UNIX returns a new unix(file) Listener.\nfunc UNIX(socketFile string, mode os.FileMode) (net.Listener, error) {\n\tif errOs := os.Remove(socketFile); errOs != nil && !os.IsNotExist(errOs) {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", socketFile, errOs)\n\t}\n\n\tl, err := net.Listen(\"unix\", socketFile)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"port already in use: %w\", err)\n\t}\n\n\tif err = os.Chmod(socketFile, mode); err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot chmod %#o for %q: %w\", mode, socketFile, err)\n\t}\n\n\treturn l, nil\n}\n\n// TLS returns a new TLS Listener and an error on failure.\nfunc TLS(addr, certFile, keyFile string) (net.Listener, error) {\n\tif certFile == \"\" || keyFile == \"\" {\n\t\treturn nil, errors.New(\"empty certFile or KeyFile\")\n\t}\n\n\tcert, err := tls.LoadX509KeyPair(certFile, keyFile)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn CERT(addr, cert)\n}","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/core/netutil/tcp.go#L62-L98","documentation":"netutil.UNIX wraps net.Listen on a unix socket path, then adjusts the socket file's permission bits with os.Chmod. If the chmod fails (e.g. the file vanished, wrong owner, or unsupported by the filesystem), the listen call is abandoned and this wrapped error is returned, preserving the underlying cause via %w.","triggerScenarios":"Calling netutil.UNIX with a socketFile on a filesystem that does not support chmod semantics (some NFS/network mounts, tmpfs with restrictions), a file system where the process lacks ownership of the freshly created socket, or the socket file being removed between Listen and Chmod.","commonSituations":"Running the app in a container as non-root while the socket directory has restrictive permissions; deploying to read-only or quirky mounted volumes (Docker bind mounts, NFS); socket path inside a directory cleaned up by another process mid-startup.","solutions":["Check the wrapped cause (%w) — fix the underlying os.Chmod error (ownership, missing file, unsupported filesystem)","Run the process with enough privilege to chmod the socket file, or pre-create the directory with correct owner/permissions","Move the socket file to a local filesystem path such as /tmp or /run where chmod is supported","Ensure no cleanup process deletes the socket file between listen and chmod"],"exampleFix":"// before\nl, err := netutil.UNIX(\"/mnt/nfs/app.sock\", 0o755)\n// after\nl, err := netutil.UNIX(\"/run/myapp/app.sock\", 0o755)","handlingStrategy":"validation","validationCode":"if fi, err := os.Stat(socketFile); err == nil {\n    if fi.Mode()&os.ModeSocket == 0 { return fmt.Errorf(\"%s exists and is not a socket\", socketFile) }\n    os.Remove(socketFile)\n}\nif err := os.MkdirAll(filepath.Dir(socketFile), 0o755); err != nil { return err }","typeGuard":"func canChmod(path string) bool {\n    fi, err := os.Stat(path)\n    return err == nil && fi.Mode().Perm() != 0\n}","tryCatchPattern":"l, err := netutil.UNIX(socketFile, 0o755)\nif err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) { log.Printf(\"chmod failed: %v\", perr.Err) }\n    return err\n}","preventionTips":["Place unix sockets on local filesystems (/run, /tmp), not NFS or bind mounts","Pre-create the socket directory with correct ownership before startup","Run the service under a user that owns the socket directory","Watch out for systemd tmpfiles or cleanup jobs deleting stale sockets at startup"],"tags":["go","unix-socket","permissions","filesystem"],"backgroundTag":"unix-socket-chmod-failed","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}