Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 0 down vote favorite

From a security point of view, is it safe to create a symbolic link to a socket file? The following bits of context refer to the deployment of a web application on a shared hosting service.

$ ls -al ~/runtime/supervisor
srwx------ 1 myuser myuser 0 Oct  6 20:02 supervisord.sock

$ pwd
~/runtime/deployment_1
$ ln -s ../supervisor/supervisor.sock
$ ls -al
lrwxrwxrwx 1 myuser myuser 47 Oct  6 21:20 supervisord.sock -> ../runtime/supervisor/supervisord.sock=

Should I set any special permissions on the symlink or something else?

share|improve this question
2  
I think it kinda depends on the application. For example, if the application deletes its socket when it shuts down gracefully, it will delete the symlink instead of the actual socket. Is this a security problem? Probably not since the only effect is that an old useless socket remains in the filesystem. I see it as more of a problem when the application restarts: it will probably recreate the socket in the wrong place. BTW, re: permissions: permissions are meaningless on symlinks. – Celada Oct 6 '12 at 22:06
1  
What do you mean by “is it safe”? The existence of the symbolic link doesn't affect the socket itself, so any risk would come from the way the symlink is used. But you're not saying anything about how the symlink is used. What threats are you worried about? What are the different programs and users involved? – Gilles Oct 6 '12 at 22:42
Sticky bit, sockets, symbolic links. These are concepts which I'm not very confident with. I just wanted to know if my configuration is safe, ie I don't want other users can access the socket through the symbolic link (rwxrwxrwx). – Guandalino Oct 7 '12 at 17:14

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.