{"record":{"id":"99e08b9d17d07a78","repo":"zeroclaw-labs/zeroclaw","slug":"local-ipc-endpoint-lock-is-not-a-regular-file","errorCode":null,"errorMessage":"local IPC endpoint lock {} is not a regular file; remove it or choose a different socket path","messagePattern":"local IPC endpoint lock (.+?) is not a regular file; remove it or choose a different socket path","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-runtime/src/rpc/local.rs","lineNumber":326,"sourceCode":"                 Restrict it (chmod go-w or +t) or point ZEROCLAW_SOCKET at a \\\n                 private directory\",\n                parent.display()\n            );\n        }\n        Ok(())\n    }\n\n    /// Rejects pre-existing lock entries that do not provide the guarantees a\n    /// freshly created lock would have.\n    ///\n    /// The inode must be a regular file owned by the current user with no\n    /// group/other access, and still linked at the time of inspection. A\n    /// foreign-owned or permissive entry could be locked by another local\n    /// user to block startup, or unlinked and recreated by its owner to hand\n    /// two daemons different lock inodes.\n    fn require_trusted_lock_file(metadata: &Metadata, lock_path: &Path) -> Result<()> {\n        if !metadata.file_type().is_file() {\n            anyhow::bail!(\n                \"local IPC endpoint lock {} is not a regular file; remove it \\\n                 or choose a different socket path\",\n                lock_path.display()\n            );\n        }\n        let euid = unsafe { libc::geteuid() };\n        if metadata.uid() != euid {\n            anyhow::bail!(\n                \"local IPC endpoint lock {} is owned by uid {}, not the \\\n                 daemon user; remove it or choose a different socket path\",\n                lock_path.display(),\n                metadata.uid()\n            );\n        }\n        if metadata.mode() & 0o077 != 0 {\n            anyhow::bail!(\n                \"local IPC endpoint lock {} is accessible to other users \\\n                 (mode {:o}); restrict it to 0600 or remove it\",","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/rpc/local.rs#L308-L344","documentation":"The pre-existing entry at `<socket>.lock` is not a regular file (it is a directory, FIFO, device, etc.). The lock protocol requires a regular file because the advisory flock and the dev/inode identity check only make sense on one; a non-regular entry could also be a DoS vector.","triggerScenarios":"Someone created a directory or named pipe at the exact lock path (mkdir $(dirname sock)/zeroclaw.sock.lock, mkfifo ...); a broken cleanup script or artifact moved a non-file onto the path; symlinks are already rejected earlier at open via O_NOFOLLOW, so this catches other file types.","commonSituations":"Accidental 'mkdir' instead of 'touch' when pre-creating runtime dirs; leftover objects from experimentation; hostile or buggy co-tenant in a shared directory.","solutions":["Inspect the entry: ls -la <socket>.lock and file <socket>.lock.","Remove the offending entry (rm -rf for a dir, rm for a fifo).","Or point ZEROCLAW_SOCKET at a different path so a fresh lock file is created.","Check for the script/tool that created the non-file so it does not reappear."],"exampleFix":"# before: zeroclaw.sock.lock is a directory\nls -ld /run/zeroclaw/zeroclaw.sock.lock   # drwxr-xr-x ...\n\n# after\nrm -rf /run/zeroclaw/zeroclaw.sock.lock\nsystemctl restart zeroclaw","handlingStrategy":"validation","validationCode":"fn lock_entry_is_regular(sock: &std::path::Path) -> bool {\n    let mut s = sock.as_os_str().to_os_string();\n    s.push(\".lock\");\n    std::fs::symlink_metadata(std::path::PathBuf::from(s))\n        .map(|m| m.file_type().is_file())\n        .unwrap_or(true) // absent is fine: daemon will create it\n}","typeGuard":null,"tryCatchPattern":"if !lock_entry_is_regular(&sock_path) {\n    anyhow::bail!(\"<socket>.lock exists but is not a regular file; remove it\");\n}","preventionTips":["Never pre-create the .lock entry; let the daemon create it.","Keep runtime dirs managed solely by the daemon, not ad-hoc scripts."],"tags":["unix","ipc","filesystem","lock-file","startup"],"backgroundTag":"invalid-file-type","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}