🔐 Been looking into hardening Unix Domain Sockets on Linux lately – here are some takeaways.

🛡️ Filesystem permissions: don’t rely on chmod on the socket file alone – some systems silently ignore it (hello SELinux). Protect the directory it lives in with 0750 and watch out for umask when calling bind() – it silently masks your intended permissions. Set umask before bind(), not chmod after.

🔍 Peer authentication: SO_PEERCRED after accept() gives you the PID, UID and GID of the connecting process, verified by the kernel. But it only captures credentials at connect() time – if the peer changes identity later, you won’t see it.

📨 Per-message auth: SCM_CREDENTIALS via sendmsg/recvmsg solves that. The kernel verifies the credentials on every message, even if the sender tries to lie. Essential when processes switch identity during their lifetime.

⚡ SOCK_SEQPACKET instead of SOCK_STREAM is worth considering. You get atomic message boundaries from the kernel – no custom framing, no partial reads, no glued-together messages.

🚦 Rate limiting unfortunately has to happen in userspace – the kernel offers nothing useful for per-peer UDS rate limiting. A simple token bucket per connection does the job.

Anyone else spent time hardening UDS? Curious what else people do beyond the basics.

#Linux #UnixDomainSockets #Security #SystemsProgramming #IPC #Infosec