{"record":{"id":"c86bc472b8edfe7d","repo":"joewalnes/websocketd","slug":"socketmode-0-would-make-the-socket-unusable-pic","errorCode":null,"errorMessage":"--socketmode 0 would make the socket unusable; pick a mode like 0700","messagePattern":"--socketmode 0 would make the socket unusable; pick a mode like 0700","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config.go","lineNumber":96,"sourceCode":"}\n\n// parseSocketMode parses the --socketmode flag: an octal permission mode\n// such as \"0700\". The empty string means \"not set\" and leaves the socket\n// file to the process umask; an explicit zero is rejected because it would\n// make the socket unusable for everyone, owner included.\nfunc parseSocketMode(s string) (os.FileMode, error) {\n\tif s == \"\" {\n\t\treturn 0, nil\n\t}\n\tmode, err := strconv.ParseUint(s, 8, 32)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"--socketmode %q is not an octal permission mode (e.g. 0700)\", s)\n\t}\n\tif mode > 0o777 {\n\t\treturn 0, fmt.Errorf(\"--socketmode %q has bits beyond permission bits (keep it within 0777)\", s)\n\t}\n\tif mode == 0 {\n\t\treturn 0, fmt.Errorf(\"--socketmode 0 would make the socket unusable; pick a mode like 0700\")\n\t}\n\treturn os.FileMode(mode), nil\n}\n\n// resolveAddresses builds the list of TCP addresses to listen on.\nfunc resolveAddresses(addrlist []string, port int) []string {\n\tif len(addrlist) > 0 {\n\t\taddrs := make([]string, len(addrlist))\n\t\tfor i, addr := range addrlist {\n\t\t\taddrs[i] = fmt.Sprintf(\"%s:%d\", addr, port)\n\t\t}\n\t\treturn addrs\n\t}\n\treturn []string{fmt.Sprintf(\":%d\", port)}\n}\n\n// resolvePort determines the listening port, using defaults for HTTP (80) or HTTPS (443).\nfunc resolvePort(portFlag int, ssl bool) int {","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/joewalnes/websocketd/blob/7a8683dc7f9778dc615945aaed2a8dc77290227b/config.go#L78-L114","documentation":"This is a validation-guard error raised by parseSocketMode when the --socketmode flag is given an explicit zero (\"0\" or \"000\"). A file mode with no permission bits denies read, write, and execute to owner, group, and others alike, so a Unix socket created with it could never be connected to — not even by its owner. The flag accepts an empty value (meaning \"use the process umask\") or a nonzero octal mode such as 0700, but an explicit zero is treated as a configuration mistake and rejected at command-line parsing time, before the socket is created.","triggerScenarios":"Running websocketd with --socketmode=0 or --socketmode=0000.","commonSituations":"Operator intending 'no restrictions' by passing 0, mistaking it for permissive (0777 is permissive; 0 denies everyone).","solutions":["Use --socketmode=0777 for a fully permissive socket","Use a restrictive-but-usable mode like 0700 (owner-only)"],"exampleFix":"// before\nwebsocketd --socketmode=0000 --port=8080 ./script.sh\n// after\nwebsocketd --socketmode=0777 --port=8080 ./script.sh","handlingStrategy":"validation","validationCode":"if (parseInt(socketMode, 8) === 0) throw new Error('socketmode 0 makes the socket unusable; use 0777 or 0700');","typeGuard":null,"tryCatchPattern":"try { setSocketMode(v) } catch { console.warn('socketmode rejected, defaulting to 0700'); setSocketMode('0700'); }","preventionTips":["Treat 0 as 'deny everyone', never as permissive","Default to 0700 (owner-only) or 0770 (group-shared) for Unix sockets"],"tags":["cli","config-validation","unix-permissions"],"backgroundTag":"invalid-octal-mode","analyzedSha":"7a8683dc7f9778dc615945aaed2a8dc77290227b","analyzedAt":"2026-09-03T13:52:22.309Z","contentChangedAt":"2026-09-03T13:52:22.309Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}