{"record":{"id":"ebfbbc6ae7920904","repo":"valyala/fasthttp","slug":"cannot-mark-listening-socket-close-on-exec-w","errorCode":null,"errorMessage":"cannot mark listening socket close-on-exec: %w","messagePattern":"cannot mark listening socket close-on-exec: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tcplisten/socket_zos_s390x.go","lineNumber":19,"sourceCode":"//go:build zos && s390x\n\npackage tcplisten\n\nimport (\n\t\"fmt\"\n\n\t\"golang.org/x/sys/unix\"\n)\n\nfunc newSocketCloexec(domain, typ, proto int) (int, error) {\n\tfd, err := unix.Socket(domain, typ, proto)\n\tif err != nil {\n\t\treturn -1, fmt.Errorf(\"cannot create listening socket: %w\", err)\n\t}\n\t_, err = unix.FcntlInt(uintptr(fd), unix.F_SETFD, unix.FD_CLOEXEC)\n\tif err != nil {\n\t\tunix.Close(fd) //nolint:errcheck\n\t\treturn -1, fmt.Errorf(\"cannot mark listening socket close-on-exec: %w\", err)\n\t}\n\t_, err = unix.FcntlInt(uintptr(fd), unix.F_SETFL, unix.O_NONBLOCK)\n\tif err != nil {\n\t\tunix.Close(fd) //nolint:errcheck\n\t\treturn -1, fmt.Errorf(\"cannot mark listening socket nonblocking: %w\", err)\n\t}\n\treturn fd, nil\n}\n","sourceCodeStart":1,"sourceCodeEnd":28,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/tcplisten/socket_zos_s390x.go#L1-L28","documentation":"On z/OS s390x, the socket was created but the subsequent unix.FcntlInt(fd, F_SETFD, FD_CLOEXEC) call to mark it close-on-exec failed. The library closes the fd and returns this error. Without CLOEXEC, the listening fd would leak into exec'd child processes, which the library treats as a hard failure.","triggerScenarios":"Calling NewListener on z/OS s390x when fcntl(F_SETFD, FD_CLOEXEC) on the fresh socket fd returns an error (e.g. EBADF if the fd is invalid, EPERM under restrictive security settings).","commonSituations":"Restricted z/OS security environments disallowing fcntl on socket descriptors; kernel-level anomalies after fd exhaustion race conditions where the fd was closed concurrently.","solutions":["Check the wrapped errno; EBADF suggests fd exhaustion/races, EPERM suggests security restrictions","Ensure RLIMIT_NOFILE/MAXFILEPROC is high enough so fd creation is stable","Verify BPX security profiles permit fcntl operations on sockets","Update Go/x-sys versions for z/OS fcntl fixes"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"ln, err := cfg.NewListener(\"tcp\", addr)\nif err != nil {\n    if strings.Contains(err.Error(), \"cannot mark listening socket close-on-exec\") {\n        var errno syscall.Errno\n        if errors.As(err, &errno) {\n            log.Printf(\"F_SETFD FD_CLOEXEC failed: %v — check security profiles and fd stability\", errno)\n        }\n        return err\n    }\n}","preventionTips":["Keep fd headroom to avoid EBADF from exhaustion races","Confirm RACF/ACF2/security software permits fcntl on socket descriptors","Run supported Go versions for z/OS","Escalate persistent failures to platform admins rather than retrying blindly"],"tags":["network","sockets","zos","s390x","fcntl","cloexec"],"backgroundTag":"fcntl-failed","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}