{"record":{"id":"d80be8fa2e350bf8","repo":"vectordotdev/vector","slug":"failed-to-set-socket-permissions","errorCode":null,"errorMessage":"Failed to set socket permissions","messagePattern":"Failed to set socket permissions","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sources/util/unix_datagram.rs","lineNumber":46,"sourceCode":"/// Returns a `Source` object corresponding to a Unix domain datagram socket.\n/// Passing in different functions for `decoder` and `handle_events` can allow\n/// for different source-specific logic (such as decoding syslog messages in the\n/// syslog source).\npub fn build_unix_datagram_source(\n    listen_path: PathBuf,\n    socket_file_mode: Option<u32>,\n    max_length: usize,\n    decoder: Decoder,\n    handle_events: impl Fn(&mut [Event], Option<Bytes>) + Clone + Send + Sync + 'static,\n    shutdown: ShutdownSignal,\n    out: SourceSender,\n) -> crate::Result<Source> {\n    Ok(Box::pin(async move {\n        let socket = UnixDatagram::bind(&listen_path).expect(\"Failed to bind to datagram socket\");\n        info!(message = \"Listening.\", path = ?listen_path, r#type = \"unix_datagram\");\n\n        change_socket_permissions(&listen_path, socket_file_mode)\n            .expect(\"Failed to set socket permissions\");\n\n        let result = listen(socket, max_length, decoder, shutdown, handle_events, out).await;\n\n        // Delete socket file.\n        if let Err(error) = remove_file(&listen_path) {\n            emit!(UnixSocketFileDeleteError {\n                path: &listen_path,\n                error\n            });\n        }\n\n        result\n    }))\n}\n\nasync fn listen(\n    socket: UnixDatagram,\n    max_length: usize,","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/src/sources/util/unix_datagram.rs#L28-L64","documentation":"After binding the unix datagram socket, Vector applies the configured `socket_file_mode` via `fs::set_permissions` (src/sources/util/unix.rs:7); this `expect(\"Failed to set socket permissions\")` panics when the chmod fails. The helper is a no-op when `socket_file_mode` is None, so the panic only fires when a mode is explicitly configured and the OS rejects the chmod — EPERM/EACCES from an LSM like SELinux, a read-only filesystem, or the socket file vanishing between bind and chmod.","triggerScenarios":"unix_datagram source with `socket_file_mode` set (e.g. 0644), running under SELinux/AppArmor that denies chmod on sockets, on a read-only fs, or racing with another process that deletes the socket right after bind.","commonSituations":"Hardened hosts with SELinux enforcing denying set_permissions; containers with read-only rootfs but the socket inside it; security agents that quarantine or remove freshly created sockets.","solutions":["Check for LSM denials (e.g. `ausearch -m avc -ts recent` for set_permissions on the socket) and add an appropriate policy exception or set the right context","Move socket_path to a writable volume (emptyDir, tmpfiles.d-managed /run) and keep socket_file_mode only if the LSM permits it","Drop `socket_file_mode` from the source config — the helper no-ops when unset, avoiding the panic","Ensure no other process deletes the socket between bind and chmod"],"exampleFix":"# before\nsources:\n  my_syslog:\n    type: syslog\n    socket_path: /var/run/vector/syslog.sock\n    socket_file_mode: 511\n# after\nsources:\n  my_syslog:\n    type: syslog\n    socket_path: /var/run/vector/syslog.sock\n    # socket_file_mode removed; relies on default umask","handlingStrategy":"validation","validationCode":"# shell: before configuring socket_file_mode\ngetenforce 2>/dev/null || true                 # SELinux state\nausearch -m avc -ts recent 2>/dev/null | grep -i set_permissions || true\nstat -c '%U %a' \"$(dirname /var/run/vector/syslog.sock)\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not set socket_file_mode on SELinux-enforcing or read-only-fs hosts unless policy allows chmod on sockets","Put sockets on a writable tmpfs/runtime volume","Test new socket_file_mode settings in staging with the same LSM profile as production"],"tags":["unix-socket","chmod","permissions","selinux","panic"],"backgroundTag":"chmod-failed","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}