Squid's Helper Can See the Module. Can It Read It?

Before adding the Squid account to another group, check cache_effective_group. In Squid 5–7, the default uses the effective user's primary and supplementary groups. An explicit override makes Squid ignore other group privileges, so the membership you just added may never reach its helper.

That is one way a Perl module can exist on disk yet fail to load. Distinguish three causes in the actual loader error: the dependency is absent, it is outside the interpreter's search path, or the service cannot read it.

Compare the module and every parent directory under the helper's runtime identity. The interpreter needs directory traversal and file reading, not just a readable final filename. After an update, vendor ownership or mode defaults may differ from the arrangement that previously worked.

Choose a narrow permission grant consistent with the intended service account and effective-group setting. Reading one dependency does not require making an entire application tree writable by the proxy. Recreate affected processes through the supported service lifecycle after group changes; existing ones may retain their old memberships.

If search paths and ordinary permissions agree, inspect the service's filesystem view and mandatory access-control evidence. A root shell loading the module successfully does not establish any of those conditions for the helper.