---
id: "bug-1592"
status: "fixed"
status_updated: "2026-09-24"
status_note: ""
component: "worker"
severity: "unknown"
timestamp: "2026-08-19T07:38:00Z"
last_seen: "2026-09-19T09:00:00Z"
occurrences: 1
files: ["src/worker/src/main.c"]
tags: ["xce-deploy-ha", "worker", "xcecd", "sudo", "permissions", "logging", "real-worker"]
related: []
legacy: true
---

# bug-1592: grep/tail: Permission denied on $TOP/logs/xcecd.log after starting the real (production) xcecd…

## Description
grep/tail: Permission denied on $TOP/logs/xcecd.log after starting the real (production) xcecd worker via sudo

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
xcecd's main log file (config.log_file, opened by the logging library at daemon startup while running as root) is created with default umask perms (verified live: root:root, mode 640) and never chmod'd permissive -- unlike xcecd_worker.log (explicit open()+chmod(0666) at main.c:536-543) and the domain socket (chmod(config.domain_sock_file, 0666) at main.c:578). Any verification command (grep/tail/cat) run as the invoking non-root user against xcecd.log fails with Permission denied.

## Fix
Documented as a known behavior in .claude/skills/xce-deploy-ha/SKILL.md: all log reads against the real worker's xcecd.log must be prefixed with sudo (sudo grep .../sudo tail ...), same as the sudo kill already required to stop the root-owned process. Not a code fix -- xcecd.log intentionally stays root-owned; only the skill's documented verification commands changed.

## Verification
_Not recorded (migrated from buglog.json)._

## References
_Not recorded (migrated from buglog.json)._