I'm trying to understand the permissions of a unix domain socket, when using an existing file, umask changes are required as well as the dir permissions.
If I create a world readable dir as root and open a socket with netcat:
root$: mkdir /tmp/mydir root$: chmod 777 /tmp/mydir root$: nc -l -U /tmp/mydir/sock
Then as a non root user try to connect to aforementioned socket it fails, though the dir is world readable as per:
In the Linux implementation, pathname sockets honor the permissions of the directory they are in. Creation of a new socket fails if the process does not have write and search (execute) permission on the directory in which the socket is created.
root$: runuser -u user1 -- nc -U /tmp/mydir/sock nc: unix connect failed: Permission denied
Now by doing
umask 0, and restarting the same socket again, it can be connected to from the non root user.
root$: umask 0 root$: nc -l -U /tmp/mydir/sock
root$: runuser -u user1 -- nc -U /tmp/mydir/sock ping
Furthermore modifying the
/tmp/mydir permissions to
chmod 600 will stop the non root user from accessing the socket again.
root$: chmod 600 /tmp/mydir root$: runuser -u user1 -- nc -U /tmp/mydir/sock nc: unix connect failed: Permission denied
It's clear the dir permissions work as intended according to the manual, but why is umask 0 required if the parent dir has the correct permissions ? Is netcat still creating some sort of other file ?