What causes "failed setting %s permissions for %s: %w" in netbirdio/netbird?

Ensure a single daemon instance per socket path

failed setting %s permissions for %s: %w

Error message

failed setting %s permissions for %s: %w

What it means

After binding a unix socket, the daemon chmods it to 0666 so unprivileged CLI/UI callers can connect; that chmod failed. The message names which listener it was setting permissions for and the socket path, wrapping the OS error.

Source

Thrown at client/cmd/service_socket.go:116

	return errors.Is(err, syscall.ECONNREFUSED)
}

func removeStaleUnixSocketForAddress(addr string) {
	network, address, err := parseListenAddress(addr)
	if err != nil || network != "unix" {
		return
	}
	removeStaleUnixSocket(address)
}

func (l *socketListener) chmodUnixSocket(description string) error {
	if l == nil || l.network != "unix" {
		return nil
	}

	if err := os.Chmod(l.address, 0666); err != nil {
		return fmt.Errorf("failed setting %s permissions for %s: %w", description, l.address, err)
	}
	return nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

Ensure a single daemon instance per socket path
Run the service as root (default) or grant ownership of the socket directory to the daemon user
Check SELinux/AppArmor audit logs for denials on the socket path
Move the socket under a standard writable path such as /var/run

Defensive patterns

Strategy: fallback

Validate before calling

if fi, err := os.Stat(filepath.Dir(socketPath)); err != nil || !fi.IsDir() {
	return fmt.Errorf("socket directory %s unusable", filepath.Dir(socketPath))
}

Try / catch

if err := l.chmodUnixSocket("daemon"); err != nil {
	// the listener is already bound; keep serving and warn rather than fail
	log.Warnf("clients may be unable to connect: %v", err)
}

Prevention

Run exactly one daemon per socket path
Run the service as root or own the socket directory
Watch LSM audit logs when hardening hosts running NetBird

When it happens

Trigger: The socket file disappears between listen and chmod (a concurrent instance running stale-socket cleanup); the daemon runs as a user that cannot chmod the path; SELinux/AppArmor denies chmod; a filesystem that rejects mode changes.

Common situations: Two daemons racing on the same --daemon-addr; hardened or containerized hosts with mandatory access control.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/31ed3db885e0361e. Report an issue: GitHub.