Is there a way to do this only if the socket doesn't already exist? This way the sysadmin could control security of his socket by changing uid/gid/permissions himself.

Maybe this can be done in a separate pull request.