Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I created a folder /tmp/me with permissions 700, and started a process under me that starts a listen socket under /tmp/me/socket.

  • I currently assume that a connection to that socket originated from a process that is running on the very same server (malicious or otherwise), and was not a connection from another server (unless through one of the processes).
  • Can I also assume that the only users who can access that socket are me, and root?

I am asking about Solaris in particular.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

I currently assume that a connection to that socket originated from a process that is running on the very same server

Correct. Filesystem sockets must be read by a process that has access to the file.

Can I also assume that the only users who can access that socket are me, and root?

Yes. Since me is the only user with permissions, they are the only ones who may enter that folder and view the socket. root, of course, is root.

share|improve this answer
    
There used to exist some Unix variants that ignored file permissions for local sockets. I can't remember which, though. –  grawity Sep 29 '13 at 5:22
    
Within man unix under debian linux you can read " This behavior differs from many BSD-derived systems which ignore permissions for UNIX domain sockets. Portable programs should not rely on this feature for security." But context of this sentence starts wih "In the Linux implementation, sockets which are visible in the filesystem honor the permissions of the directory they are in." So i can't tell if it applies to unxid domain permissions or to directory owning unix domain entry... –  philippe lhardy Mar 12 at 19:50
    
well discussion is there : unix.stackexchange.com/questions/83032/… –  philippe lhardy Mar 12 at 19:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.