vectordotdev/vector · error

Failed to set socket permissions

Error message

Failed to set socket permissions

What it means

The unix stream source binds an `UnixListener` successfully, then applies the configured `socket_file_mode` with `change_socket_permissions`; this `expect("Failed to set socket permissions")` (src/sources/util/unix_stream.rs:63) panics when the chmod fails. As with the datagram variant, the helper no-ops when `socket_file_mode` is None, so the panic requires an explicitly configured mode plus an OS-level chmod failure (LSM/SELinux denial, read-only filesystem, or the socket file disappearing before chmod).

Source

Thrown at src/sources/util/unix_stream.rs:63

    out: SourceSender,
) -> crate::Result<Source>
where
    D: tokio_util::codec::Decoder<Item = (F, usize), Error = E> + Clone + Send + 'static,
    E: StreamDecodingError + std::fmt::Display + Send + From<std::io::Error>,
    F: Into<SmallVec<[Event; 1]>> + Send,
{
    Ok(Box::pin(async move {
        let listener = UnixListener::bind(&listen_path).unwrap_or_else(|e| {
            panic!(
                "Failed to bind to listener socket at path: {}. Err: {}",
                listen_path.to_string_lossy(),
                e
            )
        });
        info!(message = "Listening.", path = ?listen_path, r#type = "unix");

        change_socket_permissions(&listen_path, socket_file_mode)
            .expect("Failed to set socket permissions");

        let bytes_received = register!(BytesReceived::from(Protocol::UNIX));

        let connection_open = OpenGauge::new();
        let stream = UnixListenerStream::new(listener).take_until(shutdown.clone());
        tokio::pin!(stream);
        while let Some(socket) = stream.next().await {
            let socket = match socket {
                Err(error) => {
                    error!(message = "Failed to accept socket.", %error);
                    continue;
                }
                Ok(socket) => socket,
            };

            let listen_path = listen_path.clone();

            let span = info_span!("connection");

View on GitHub (pinned to 3708c39b12)

Solutions

1. Check audit logs for set_permissions denials on the socket path and grant the exception or fix the file context
2. Place socket_path on a writable directory owned by the Vector process
3. Remove `socket_file_mode` from the config so the permission step is skipped
4. Verify nothing (tmpfiles cleaner, security agent) removes the socket between bind and chmod

Example fix

# before
sources:
  vector_metrics:
    type: socket
    mode: unix
    path: /var/run/vector/stream.sock
    socket_file_mode: 511
# after
sources:
  vector_metrics:
    type: socket
    mode: unix
    path: /var/run/vector/stream.sock
    # socket_file_mode removed

# shell: verify the process may chmod in the target directory
touch /var/run/vector/.permtest && chmod 511 /var/run/vector/.permtest && rm /var/run/vector/.permtest
getenforce 2>/dev/null || true

When it happens

Trigger: unix socket (stream) source — e.g. socket-vector source or custom unix stream inputs — with `socket_file_mode` configured, running under an LSM that denies set_permissions, on a read-only fs, or with an external actor removing the socket file immediately after bind.

Common situations: SELinux enforcing on RHEL/CentOS nodes denying chmod on the socket; containers with read-only rootfs; misconfigured socket_file_mode values applied on paths managed by systemd-tmpfiles with restrictive policies.

Related errors

• Failed to set socket permissions
• Failed to bind to listener socket at path: {}. Err: {}
• MessageStream never calls Ready(None)
• MessageStream never returns Ready(None)
• Failed to bind to datagram socket

AI-assisted analysis of vectordotdev/vector@3708c39b12 (2026-08-20). Data as JSON: /api/errors/779efd0c9d332abb. Report an issue: GitHub.