Unix socket file permission #1069

New Issue

2026-10-05T05:01:21+02:00

adam commented

2026-10-05 05:01:21 +02:00

Is there any way to set the access mode of the socket? I couldn't find any documentation or clues in the diff.

I'm trying to proxy the HTTP traffic, and it only connects if it's writable (ideally 0666), but the socket is created as 0755.

Originally posted by @frostyfalls in https://github.com/znc/znc/issues/1945#issuecomment-2957966787

Is there any way to set the access mode of the socket? I couldn't find any documentation or clues in the diff. I'm trying to proxy the HTTP traffic, and it only connects if it's writable (ideally 0666), but the socket is created as 0755. _Originally posted by @frostyfalls in https://github.com/znc/znc/issues/1945#issuecomment-2957966787_

adam closed this issue

2026-10-05 05:01:21 +02:00

adam commented

2026-10-05 05:01:22 +02:00

There's no!

It wasn't an issue in my manual tests, and in the ZNC's integration test which is using unix socket almost everywhere now.

Does that proxy specifically check what mode the file has?

There's no! It wasn't an issue in my manual tests, and in the ZNC's integration test which is using unix socket almost everywhere now. Does that proxy specifically check what mode the file has?

adam commented

2026-10-05 05:01:23 +02:00

I'm not quite sure, but it's HAProxy. If it wasn't writable by the user its running as, it would just return a 503. My workaround solution was this for systemd:

[Service]
RuntimeDirectory=znc
RuntimeDirectoryMode=0755
UMask=0111

Here's the HAProxy configuration, if interested:

global
    user haproxy
    group haproxy

defaults
    log global
    mode http
    timeout connect 10s
    timeout client 30s
    timeout server 30s

frontend default
    bind :::80 v4v6
    bind :::443 v4v6 ssl crt /etc/haproxy/ssl/
    http-request redirect scheme https unless { ssl_fc }
    use_backend %[req.hdr(Host),lower]
    default_backend no-match

backend no-match
    http-request deny deny_status 404

backend znc.internal.domain
    option forwardfor
    server default /run/znc/znc.sock

I'm not quite sure, but it's HAProxy. If it wasn't writable by the user its running as, it would just return a 503. My workaround solution was this for systemd: ``` [Service] RuntimeDirectory=znc RuntimeDirectoryMode=0755 UMask=0111 ``` Here's the HAProxy configuration, if interested: ``` global user haproxy group haproxy defaults log global mode http timeout connect 10s timeout client 30s timeout server 30s frontend default bind :::80 v4v6 bind :::443 v4v6 ssl crt /etc/haproxy/ssl/ http-request redirect scheme https unless { ssl_fc } use_backend %[req.hdr(Host),lower] default_backend no-match backend no-match http-request deny deny_status 404 backend znc.internal.domain option forwardfor server default /run/znc/znc.sock ```

adam commented

2026-10-05 05:01:23 +02:00

Ah, HAProxy is simply running not as the same user as ZNC, that's why permission is denied

Ah, HAProxy is simply running not as the same user as ZNC, that's why permission is denied

adam commented

2026-10-05 05:01:24 +02:00

Indeed; all my other software that I proxy creates their sockets with world writable permissions.

Indeed; all my other software that I proxy creates their sockets with world writable permissions.

adam commented

2026-10-05 05:01:25 +02:00

@frostyfalls please test

@frostyfalls please test

adam commented

2026-10-05 05:01:25 +02:00

Hey I apologize for not seeing this. It seems to work as intended. Much appreciated :)

Hey I apologize for not seeing this. It seems to work as intended. Much appreciated :)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#1069