cilium/cilium · error

cannot set default permissions on socket %s: %w

Error message

cannot set default permissions on socket %s: %w

What it means

When running as root, buildServer calls api.SetDefaultPermissions to relax/group-assign the socket file so non-root clients may connect. On failure it closes the just-created listener and returns 'cannot set default permissions on socket'. The socket itself was bound fine; only the ownership/mode adjustment failed, but the server refuses to start with wrong permissions.

Source

Thrown at pkg/monitor/agent/server.go:35

// buildServer opens a listener socket at path. It exits with logging on all
// errors.
func buildServer(logger *slog.Logger, path string) (*net.UnixListener, error) {
	addr, err := net.ResolveUnixAddr("unix", path)
	if err != nil {
		return nil, fmt.Errorf("cannot resolve unix address %s: %w", path, err)
	}
	os.Remove(path)
	server, err := net.ListenUnix("unix", addr)
	if err != nil {
		return nil, fmt.Errorf("cannot listen on unix socket %s: %w", path, err)
	}

	if os.Getuid() == 0 {
		err := api.SetDefaultPermissions(logger.Debug, path)
		if err != nil {
			server.Close()
			return nil, fmt.Errorf("cannot set default permissions on socket %s: %w", path, err)
		}
	}

	return server, nil
}

// server serves the Cilium monitor API on the unix domain socket
type server struct {
	logger   *slog.Logger
	listener net.Listener
	monitor  Agent
}

// ServeMonitorAPI serves the Cilium 1.2 monitor API on a unix domain socket.
// This method starts the server in the background. The server is stopped when
// ctx is cancelled. Each incoming connection registers a new listener on
// monitor.
func ServeMonitorAPI(ctx context.Context, logger *slog.Logger, monitor Agent, queueSize int) error {

View on GitHub (pinned to ac7b90affa)

Solutions

1. Read the wrapped error to see if it's EPERM/EOPNOTSUPP (filesystem won't allow chown/chmod) or a missing group.
2. Move the socket path to a local filesystem (tmpfs/ext4) that supports ownership changes.
3. Preserve CAP_CHOWN/CAP_FOWNER in the container securityContext if capabilities were dropped.
4. Adjust or allowlist SELinux/AppArmor rules permitting attribute changes on the socket path.
5. If permissions are managed externally (init container / systemd tmpfiles), make SetDefaultPermissions failure non-fatal by pre-creating the socket dir with correct ownership.

Example fix

// before
err := api.SetDefaultPermissions(logger.Debug, path)
if err != nil {
    server.Close()
    return nil, fmt.Errorf("cannot set default permissions on socket %s: %w", path, err)
}
// after
if err := api.SetDefaultPermissions(logger.Debug, path); err != nil {
    logger.Warn("could not set socket permissions; relying on external setup", logfields.Error, err)
}

if os.Getuid() == 0 {
    // verify chown/chmod on the target path is permitted before binding
    tmp := filepath.Join(filepath.Dir(sockPath), ".permtest")
    if err := os.WriteFile(tmp, nil, 0o660); err == nil {
        err = os.Chmod(tmp, 0o660)
        os.Remove(tmp)
        if err != nil {
            logger.Warn("socket permission changes unavailable on this fs", "err", err)
        }
    }
}

server, err := buildServer(logger, path)
if err != nil && strings.Contains(err.Error(), "cannot set default permissions") {
    logger.Warn("socket created but permission setup failed; ensure external perms (systemd tmpfiles/init)", "path", path)
}

When it happens

Trigger: Running as uid 0 and calling buildServer when chown/chmod on the socket path fails — e.g. the socket lives on a filesystem disallowing ownership changes (some bind mounts, NFS), or the target group in SetDefaultPermissions does not exist.

Common situations: Socket placed on an overlay/NFS mount that rejects chown, SELinux denials on attribute changes, or a hardened runtime dropping CAP_CHOWN/CAP_FOWNER so root's permission changes are refused.

Related errors

• cannot listen on unix socket %s: %w
• Failed to open file %s for writing: %w
• could not create report dir %q: %w
• failed to create directory %s: %w
• failed to create temp file %s: %w

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/80b141513acd7725. Report an issue: GitHub.