Skip to content
stellvia.dev

Unix Sockets and File Descriptors

The owner, group, and permissions of a Unix domain socket, and file descriptors opened by a privileged process, can form privilege boundaries distinct from file paths. See Network and IPC for how to find sockets.

Observation

Section titled “Observation”
Terminal window
ss -lxnp
find /run /var/run -maxdepth 3 -type s -ls 2>/dev/null
ls -l /run/<app>/<name>.sock

Hypothesis

Section titled “Hypothesis”
  • The socket’s group and mode allow only another user to connect to the management API.
  • The daemon passes a file descriptor opened with higher privileges, or accepts a privileged action.

Verification

Section titled “Verification”
Terminal window
id
stat /run/<app>/<name>.sock
lsof -U | grep <app>
  • Purpose: Check which users can connect, the daemon’s running user, and the relationship between the socket and process.
  • Prerequisites: Connecting to a socket may start processing. Read the implementation or protocol first.
  • Interpreting output: With srw-rw---- root group, group membership determines connection access. SCM_RIGHTS can pass a descriptor for a file that cannot be read through its path permissions.
  • Troubleshooting: Check for a group mismatch, wrong socket path, stopped daemon, or abstract namespace socket.
  • Alternative: socat - UNIX-CONNECT:<sock> may change state merely by connecting. Read the implementation before using it.
  • State changes: stat only reads information. A connection may change state depending on the application.

/proc/<PID>/fd offers clues about files opened through paths other than their own permissions. Reading it may require the same user or higher privileges; being unable to read it also reveals a privilege boundary. See Processes and systemd for how to examine processes.

As a low-privilege user, use ss and ps to associate a root daemon with /run/<app>/<name>.sock. If the implementation enters lockdown on a detection term in its logs and then passes a configuration file’s FD through the socket with SCM_RIGHTS, the recipient can obtain a root-owned file that its path permissions would otherwise prevent it from reading.

Detection term in log
  ↓
Root daemon enters lockdown
  ↓
Unix socket / SCM_RIGHTS
  ↓
FD for secret file
  ↓
Read privileged file

Check group membership and the implementation before connecting. Do not send input to the socket without reading its protocol.