{"record":{"id":"9ff824d4caf76c85","repo":"hashicorp/nomad","slug":"unable-to-set-permissions-on-unix-socket-for-consu","errorCode":null,"errorMessage":"unable to set permissions on unix socket for Consul gRPC endpoint: %v","messagePattern":"unable to set permissions on unix socket for Consul gRPC endpoint: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/allocrunner/consul_grpc_sock_hook.go","lineNumber":299,"sourceCode":"\t\terr := os.Remove(hostGRPCSocketPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\n\t\t\t\t\"unable to remove existing unix socket for Consul gRPC endpoint: %v\", err)\n\t\t}\n\t}\n\n\tlistener, err := net.Listen(\"unix\", hostGRPCSocketPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to create unix socket for Consul gRPC endpoint: %v\", err)\n\t}\n\n\t// The gRPC socket should be usable by all users in case a task is\n\t// running as an unprivileged user.  Unix does not allow setting domain\n\t// socket permissions when creating the file, so we must manually call\n\t// chmod afterwards.\n\t// https://github.com/golang/go/issues/11822\n\tif err := os.Chmod(hostGRPCSocketPath, os.ModePerm); err != nil {\n\t\treturn fmt.Errorf(\"unable to set permissions on unix socket for Consul gRPC endpoint: %v\", err)\n\t}\n\n\tgo func() {\n\t\tproxy(p.ctx, p.logger, destAddr, listener)\n\t\tp.cancel()\n\t\tclose(p.doneCh)\n\t}()\n\n\tp.runOnce = true\n\treturn nil\n}\n\n// stop the proxy and blocks until the proxy has stopped. Returns an error if\n// the proxy does not exit in a timely fashion.\nfunc (p *grpcSocketProxy) stop() error {\n\tp.cancel()\n\n\t// If proxy was never run, don't wait for anything to shutdown.","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/allocrunner/consul_grpc_sock_hook.go#L281-L317","documentation":"After creating the unix socket, Nomad chmods it so unprivileged task users can connect (unix does not allow setting permissions at bind time); the chmod call failed, so the socket exists but would be unusable by tasks, and run aborts.","triggerScenarios":"Thrown at client/allocrunner/consul_grpc_sock_hook.go:299 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check ownership/permissions of the socket file and alloc dir","Ensure the Nomad client process has rights to chmod within the alloc dir","Check for LSM (SELinux/AppArmor) denials in audit logs"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}