{"record":{"id":"fa0147c4b68467f8","repo":"slimtoolkit/slim","slug":"insufficient-permissions","errorCode":null,"errorMessage":"insufficient permissions","messagePattern":"insufficient permissions","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/app/sensor/monitor/composite.go","lineNumber":38,"sourceCode":"\t\"github.com/slimtoolkit/slim/pkg/report\"\n\t\"github.com/slimtoolkit/slim/pkg/util/errutil\"\n)\n\nconst (\n\tsignalChanBufSize = 10\n\n\terrorChanBufSize   = 100\n\terrorChanDrainTime = 200 * time.Millisecond\n\n\t// Some monitors are passive. If the driving monitor\n\t// is too fast, the passive ones may not have a chance\n\t// to track all the needed events (used to happen often\n\t// between the driving ptrace and observing fanotify mons).\n\tminPassiveMonitoring = 1 * time.Second\n)\n\nvar (\n\tErrInsufficientPermissions = errors.New(\"insufficient permissions\")\n)\n\ntype CompositeReport struct {\n\tPeReport  *report.PeMonitorReport\n\tFanReport *report.FanMonitorReport\n\tPtReport  *report.PtMonitorReport\n}\n\ntype CompositeMonitor interface {\n\t// Start() is not reentrant!\n\tStart() error\n\n\t// Just a helper getter.\n\tStartCommand() *command.StartMonitor\n\n\tSignalTargetApp(s os.Signal)\n\n\tCancel()","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/slimtoolkit/slim/blob/81940d17fa112cc678e32209214bcb2355cb3004/pkg/app/sensor/monitor/composite.go#L20-L56","documentation":"ErrInsufficientPermissions is a sentinel error from the composite monitor, returned by Run and Start when the monitor cannot obtain the privileges or kernel interfaces it needs for passive monitoring (e.g., ptrace, fanotify). Monitoring containers/events requires elevated capabilities; without them the composite monitor refuses to start with incomplete coverage.","triggerScenarios":"Starting/running the composite monitor without root or without CAP_SYS_PTRACE/CAP_SYS_ADMIN; running inside a container with a restrictive seccomp/AppArmor profile that blocks ptrace or fanotify syscalls; kernel without fanotify permission hooks enabled for the caller.","commonSituations":"Running slim/sensor as a non-root user; Docker containers without --cap-add SYS_PTRACE/SYS_ADMIN; Kubernetes pods without privileged securityContext; hardened hosts disabling fanotify/ptrace.","solutions":["Run the sensor with sufficient privileges (as root, or docker run with --cap-add SYS_PTRACE --cap-add SYS_ADMIN)","Set the Kubernetes/container securityContext to add the required capabilities (privileged only if necessary)","Verify the seccomp/AppArmor profile permits ptrace and fanotify (use unconfined profile for probing)","Reduce monitor configuration to passive-only if elevated privileges cannot be granted"],"exampleFix":"# before\ndocker run --rm slimimage analyze target\n# after\ndocker run --rm --cap-add SYS_PTRACE --cap-add SYS_ADMIN slimimage analyze target","handlingStrategy":"type-guard","validationCode":"// Go: check effective capabilities before starting the monitor\ndata, _ := os.ReadFile(\"/proc/self/status\")\nif !strings.Contains(string(data), \"CapEff\") {\n    // pre-check failed\n}\n// prefer: require root or CAP_SYS_PTRACE/CAP_SYS_ADMIN in your launcher","typeGuard":"func IsInsufficientPermissions(err error) bool {\n    return errors.Is(err, composite.ErrInsufficientPermissions)\n}","tryCatchPattern":"if err := mon.Run(ctx); err != nil {\n    if errors.Is(err, composite.ErrInsufficientPermissions) {\n        // advise: rerun with root / --cap-add SYS_PTRACE --cap-add SYS_ADMIN\n    }\n    return err\n}","preventionTips":["Run probes as root or grant SYS_PTRACE/SYS_ADMIN capabilities","Use an unconfined seccomp/AppArmor profile for monitoring runs","In Kubernetes, set securityContext capabilities explicitly","Check kernel support for fanotify/ptrace before deploying probes"],"tags":["permissions","monitoring","ptrace","fanotify","go"],"backgroundTag":"insufficient-permissions","analyzedSha":"81940d17fa112cc678e32209214bcb2355cb3004","analyzedAt":"2026-08-31T23:06:12.682Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}