slimtoolkit/slim · error

insufficient permissions

Error message

insufficient permissions

What it means

ErrInsufficientPermissions is a sentinel error from the composite monitor, returned by Run and Start when the monitor cannot obtain the privileges or kernel interfaces it needs for passive monitoring (e.g., ptrace, fanotify). Monitoring containers/events requires elevated capabilities; without them the composite monitor refuses to start with incomplete coverage.

Source

Thrown at pkg/app/sensor/monitor/composite.go:38

	"github.com/slimtoolkit/slim/pkg/report"
	"github.com/slimtoolkit/slim/pkg/util/errutil"
)

const (
	signalChanBufSize = 10

	errorChanBufSize   = 100
	errorChanDrainTime = 200 * time.Millisecond

	// Some monitors are passive. If the driving monitor
	// is too fast, the passive ones may not have a chance
	// to track all the needed events (used to happen often
	// between the driving ptrace and observing fanotify mons).
	minPassiveMonitoring = 1 * time.Second
)

var (
	ErrInsufficientPermissions = errors.New("insufficient permissions")
)

type CompositeReport struct {
	PeReport  *report.PeMonitorReport
	FanReport *report.FanMonitorReport
	PtReport  *report.PtMonitorReport
}

type CompositeMonitor interface {
	// Start() is not reentrant!
	Start() error

	// Just a helper getter.
	StartCommand() *command.StartMonitor

	SignalTargetApp(s os.Signal)

	Cancel()

View on GitHub (pinned to 81940d17fa)

Solutions

1. Run the sensor with sufficient privileges (as root, or docker run with --cap-add SYS_PTRACE --cap-add SYS_ADMIN)
2. Set the Kubernetes/container securityContext to add the required capabilities (privileged only if necessary)
3. Verify the seccomp/AppArmor profile permits ptrace and fanotify (use unconfined profile for probing)
4. Reduce monitor configuration to passive-only if elevated privileges cannot be granted

Example fix

# before
docker run --rm slimimage analyze target
# after
docker run --rm --cap-add SYS_PTRACE --cap-add SYS_ADMIN slimimage analyze target

// Go: check effective capabilities before starting the monitor
data, _ := os.ReadFile("/proc/self/status")
if !strings.Contains(string(data), "CapEff") {
    // pre-check failed
}
// prefer: require root or CAP_SYS_PTRACE/CAP_SYS_ADMIN in your launcher

func IsInsufficientPermissions(err error) bool {
    return errors.Is(err, composite.ErrInsufficientPermissions)
}

if err := mon.Run(ctx); err != nil {
    if errors.Is(err, composite.ErrInsufficientPermissions) {
        // advise: rerun with root / --cap-add SYS_PTRACE --cap-add SYS_ADMIN
    }
    return err
}

When it happens

Trigger: Starting/running the composite monitor without root or without CAP_SYS_PTRACE/CAP_SYS_ADMIN; running inside a container with a restrictive seccomp/AppArmor profile that blocks ptrace or fanotify syscalls; kernel without fanotify permission hooks enabled for the caller.

Common situations: Running slim/sensor as a non-root user; Docker containers without --cap-add SYS_PTRACE/SYS_ADMIN; Kubernetes pods without privileged securityContext; hardened hosts disabling fanotify/ptrace.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• one or more monitors failed: fanotify.error=%q, ptrace.error
• sensor shutdown before monitor stop
• insufficient socket permissions (can_read=%v can_write=%v)
• unexpected app exit
• ambiguous start command: cannot use [app_name,app_args] and

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/fa0147c4b68467f8. Report an issue: GitHub.