---
title: The docker.socket file should be owned by root
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The docker.socket file should be owned
  by root
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The docker.socket file should be owned by root
Classification:complianceFramework:cis-dockerControl:3.3 
## Description{% #description %}

The `docker.socket` unit file should be owned by user root and group root.

## Rationale{% #rationale %}

The `docker.socket` unit creates the socket of the Docker daemon. Its owner can change it, so the owner and group should be root only.

## Audit{% #audit %}

Find the unit file that systemd uses, then show its owner and group:

```bash
systemctl show -p FragmentPath docker.socket
stat -c '%U:%G' /usr/lib/systemd/system/docker.socket
```

Datadog checks `docker.socket` in `/etc/systemd/system`, `/run/systemd/system`, `/usr/local/lib/systemd/system`, `/usr/lib/systemd/system`, or `/lib/systemd/system`. It passes the rule when every copy found belongs to root:root, fails it when one belongs to another user or group, and reports it not applicable when there is none.

## Remediation{% #remediation %}

Set the owner and group of the unit file that systemd uses:

```bash
chown root:root /usr/lib/systemd/system/docker.socket
```

## Impact{% #impact %}

None.

## Default value{% #default-value %}

The Docker packages install the unit files in `/usr/lib/systemd/system` with owner root:root and mode 644.

## References{% #references %}

1. [https://docs.docker.com/reference/cli/dockerd/#daemon-socket-option](https://docs.docker.com/reference/cli/dockerd/#daemon-socket-option)