vectordotdev/vector · error

Failed to set socket permissions

Error message

Failed to set socket permissions

What it means

After binding the unix datagram socket, Vector applies the configured `socket_file_mode` via `fs::set_permissions` (src/sources/util/unix.rs:7); this `expect("Failed to set socket permissions")` panics when the chmod fails. The helper is a no-op when `socket_file_mode` is None, so the panic only fires when a mode is explicitly configured and the OS rejects the chmod — EPERM/EACCES from an LSM like SELinux, a read-only filesystem, or the socket file vanishing between bind and chmod.

Source

Thrown at src/sources/util/unix_datagram.rs:46

/// Returns a `Source` object corresponding to a Unix domain datagram socket.
/// Passing in different functions for `decoder` and `handle_events` can allow
/// for different source-specific logic (such as decoding syslog messages in the
/// syslog source).
pub fn build_unix_datagram_source(
    listen_path: PathBuf,
    socket_file_mode: Option<u32>,
    max_length: usize,
    decoder: Decoder,
    handle_events: impl Fn(&mut [Event], Option<Bytes>) + Clone + Send + Sync + 'static,
    shutdown: ShutdownSignal,
    out: SourceSender,
) -> crate::Result<Source> {
    Ok(Box::pin(async move {
        let socket = UnixDatagram::bind(&listen_path).expect("Failed to bind to datagram socket");
        info!(message = "Listening.", path = ?listen_path, r#type = "unix_datagram");

        change_socket_permissions(&listen_path, socket_file_mode)
            .expect("Failed to set socket permissions");

        let result = listen(socket, max_length, decoder, shutdown, handle_events, out).await;

        // Delete socket file.
        if let Err(error) = remove_file(&listen_path) {
            emit!(UnixSocketFileDeleteError {
                path: &listen_path,
                error
            });
        }

        result
    }))
}

async fn listen(
    socket: UnixDatagram,
    max_length: usize,

View on GitHub (pinned to 3708c39b12)

Solutions

1. Check for LSM denials (e.g. `ausearch -m avc -ts recent` for set_permissions on the socket) and add an appropriate policy exception or set the right context
2. Move socket_path to a writable volume (emptyDir, tmpfiles.d-managed /run) and keep socket_file_mode only if the LSM permits it
3. Drop `socket_file_mode` from the source config — the helper no-ops when unset, avoiding the panic
4. Ensure no other process deletes the socket between bind and chmod

Example fix

# before
sources:
  my_syslog:
    type: syslog
    socket_path: /var/run/vector/syslog.sock
    socket_file_mode: 511
# after
sources:
  my_syslog:
    type: syslog
    socket_path: /var/run/vector/syslog.sock
    # socket_file_mode removed; relies on default umask

# shell: before configuring socket_file_mode
getenforce 2>/dev/null || true                 # SELinux state
ausearch -m avc -ts recent 2>/dev/null | grep -i set_permissions || true
stat -c '%U %a' "$(dirname /var/run/vector/syslog.sock)"

When it happens

Trigger: unix_datagram source with `socket_file_mode` set (e.g. 0644), running under SELinux/AppArmor that denies chmod on sockets, on a read-only fs, or racing with another process that deletes the socket right after bind.

Common situations: Hardened hosts with SELinux enforcing denying set_permissions; containers with read-only rootfs but the socket inside it; security agents that quarantine or remove freshly created sockets.

Related errors

• Failed to set socket permissions
• Failed to bind to listener socket at path: {}. Err: {}
• Failed to bind to datagram socket
• path and query should never fail to parse
• Serializer does not support JSON

AI-assisted analysis of vectordotdev/vector@3708c39b12 (2026-08-20). Data as JSON: /api/errors/d80be8fa2e350bf8. Report an issue: GitHub.