When I run netstat --protocol unix or lsof -U I see that some unix socket paths are prepended with @ symbol, for example, @/tmp/dbus-qj8V39Yrpa. Then when I run ls -l /tmp I don't see file named dbus-qj8V39Yrpa there.

The question is what does that prepended @ symbol denote? And second related question, is -- where can I actually find that unix socket file (@/tmp/dbus-qj8V39Yrpa) on the filesystem?

  • For what it's worth, the more modern ss program also shows socket endpoints like "@/tmp/.X11-unix/X0" – Bruce Ediger May 29 '15 at 19:52
up vote 26 down vote accepted

The @ probably indicates a socket held in an abstract namespace which doesn't belong to a file in the filesystem.

Quoting from The Linux Programming Interface by Michael Kerrisk:

57.6 The Linux Abstract Socket Namespace

The so-called abstract namespace is a Linux-specific feature that allows us to bind a UNIX domain socket to a name without that name being created in the file system. This provides a few potential advantages:

  • We don’t need to worry about possible collisions with existing names in the file system.
  • It is not necessary to unlink the socket pathname when we have finished using the socket. The abstract name is automatically removed when the socket is closed.
  • We don’t need to create a file-system pathname for the socket. This may be useful in a chroot environment, or if we don’t have write access to a file system.

To create an abstract binding, we specify the first byte of the sun_path field as a null byte (\0). [...]

Displaying a leading null byte to denote such type of a socket may be difficult, so that is maybe the reason for the leading @ sign.

  • 1
    It's noteworthy that the ASCII NUL character is entered in many terminals as ^@ ([Ctrl]+[@]) and it can show up as ^@ when displayed by various Unix commands (such as GNU cat -a). – Jim Dennis Aug 6 at 2:57

As per man 7 unix

  • abstract: an abstract socket address is distinguished by the fact that sun_path[0] is a null byte (\0). All of the remaining bytes in sun_path define the "name" of the socket. (Null bytes in the name have no special significance.) The name has no connection with file system pathnames. The socketâs address in this namespace is given by the rest of the bytes in sun_path. When the address of an abstract socket is returned by getsockname(2), getpeername(2), and accept(2), its length is sizeof(struct sockaddr_un), and sun_path contains the abstract name. The abstract socket namespace is a non-portable Linux extension.

Looks like these are 'abstract' - so no real path is present on filesystem

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.