The permissions on the cman client socket are deliberate - we really don't want any old process accessing the cluster manager.

The socket permissions are 0660 which means you should be able to grant access to non-root processes by giving them access the appropriate group. The group defaults to 'root' too, but is easily changed.

(In reply to Christine Caulfield from comment #2)
> The permissions on the cman client socket are deliberate - we really don't
> want any old process accessing the cluster manager.
> 
> The socket permissions are 0660 which means you should be able to grant
> access to non-root processes by giving them access the appropriate group.
> The group defaults to 'root' too, but is easily changed.

I'm experiencing the same problem as the original poster.  I can solve the problem temporarily by changing the group ownership on the cman socket file.  However, this solution is only temporary; it needs to be repeated if the system is rebooted or cman is restarted.  Is there a way to configure cman so it will create its socket with group permissions other than root (e.g. with group haclient)?

Below shows the details of the temporary solution, which may be useful for testing a more permanent solution.

This command shows the problem.  Executing this as a privileged user (e.g. root) has no errors.
cman_tool nodes -F id,name
cman_tool: Cannot open connection to cman, permission denied.

The permissions on the cman socket file are exactly as the original poster described (writable to user and group, but user and group are both "root").
ls -ltr /var/run/cman_client 
srw-rw----. 1 root root 0 Jan 22 16:38 /var/run/cman_client

I am able to fix the problem by changing the group permissions on the cman socket file, e.g.
  sudo chgrp haclient /var/run/cman_client

Now users that are part of the haclient group can run this command successfully:
cman_tool nodes -F id,name
1 qc-sfc-obs1 
2 qc-sfc-obs2