From b777bcb81ad7230a26b498f9bb19ec54017a0494 Mon Sep 17 00:00:00 2001
From: ginuerzh <ginuerzh@gmail.com>
Date: Thu, 25 Jun 2026 16:04:04 +0800
Subject: [PATCH] feat(listener/unix): add mode metadata to chmod unix socket
 file

Add a "mode" metadata key to the unix listener so users can set the
file permissions on the unix domain socket after it is created. This
allows programs running under a different user/group to connect to the
socket without requiring a global umask override.

Values accept Go-style octal (0660), Go literal (0o660), or decimal
(432), both via URL query params and YAML config files.

Fixes go-gost/gost#878
---
 listener/unix/listener.go |  7 +++++++
 listener/unix/metadata.go | 18 +++++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/listener/unix/listener.go b/listener/unix/listener.go
index 22e27a6f..2680f326 100644
--- a/listener/unix/listener.go
+++ b/listener/unix/listener.go
@@ -2,6 +2,7 @@ package unix
 
 import (
 	"net"
+	"os"
 	"time"
 
 	"github.com/go-gost/core/limiter"
@@ -48,6 +49,12 @@ func (l *unixListener) Init(md md.Metadata) (err error) {
 	if err != nil {
 		return
 	}
+	if l.md.fileMode > 0 {
+		if err = os.Chmod(l.options.Addr, l.md.fileMode); err != nil {
+			ln.Close()
+			return
+		}
+	}
 
 	ln = proxyproto.WrapListener(l.options.ProxyProtocol, ln, 10*time.Second)
 	ln = metrics.WrapListener(l.options.Service, ln)
diff --git a/listener/unix/metadata.go b/listener/unix/metadata.go
index 767bce40..fd17ca71 100644
--- a/listener/unix/metadata.go
+++ b/listener/unix/metadata.go
@@ -1,11 +1,27 @@
 package unix
 
 import (
+	"os"
+	"strconv"
+
 	md "github.com/go-gost/core/metadata"
 )
 
-type metadata struct{}
+type metadata struct {
+	fileMode os.FileMode
+}
 
 func (l *unixListener) parseMetadata(md md.Metadata) (err error) {
+	if !md.IsExists("mode") {
+		return
+	}
+
+	switch v := md.Get("mode").(type) {
+	case int:
+		l.md.fileMode = os.FileMode(v)
+	case string:
+		n, _ := strconv.ParseInt(v, 0, 32)
+		l.md.fileMode = os.FileMode(n)
+	}
 	return
 }