magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

MGS9022: socket peer is not the server's user

The server answered 403 forbidden on its unix socket because the process on the other end of the connection is not running as the user the server runs as.

[MGS9022] this socket admits only processes running as uid 501; this connection's peer runs as uid 0
  see: .../MGS9022.md

Why

The server's socket takes no bearer token, for its control operations, MCP or the APIs alike. What admits a caller is the user it runs as: the kernel reports the peer's uid for every unix socket connection (SO_PEERCRED on Linux, LOCAL_PEERCRED on macOS), and the server admits only its own. The socket also sits in the private (0700) runtime directory, so this refusal means something reached it anyway, root for one, or the kernel would not say who connected.

Resolution

Connect as the user that started magus server. A client that has to run as another user takes the loopback HTTP endpoint and a token instead: magus config mcp connector create for MCP, magus config console token create for the APIs.

What this is NOT

  • Not a bearer refusal. A token that was presented and refused is MGS9001; the socket never reads one.
  • Not the loopback check. A TCP peer off the loopback interface is MGS9008.

See also

MGS9022authserversocketpeer403
Last updated (a43ac9db)
Glossary

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Server

The background process a person starts with magus server start. It serves MCP, the console, background jobs and the warm knowledge graph, and adopts nested magus calls into one pool. See server.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.