Unix Sockets

Cybersecurity 17 Sep 2026 7 min read

Unix Socket Peer Credentials Bind Identity to a Local Connection

Unix Socket Peer Credentials Bind Identity to a Local Connection A privileged local service often accepts requests from processes that share the same host but do not share the same authority. A pathname on a Unix domain socket can control who reaches the listener, yet a successful connection does not by itself tell the service which process is on the other end. Linux provides a second boundary: SO_PEERCRED lets a connected Unix socket expose peer credentials supplied by the kernel.

Cybersecurity Linux

Cybersecurity 17 Sep 2026 6 min read

SCM_RIGHTS Transfers File-Descriptor Authority Across Unix Sockets

SCM_RIGHTS Transfers File-Descriptor Authority Across Unix Sockets A privileged service can open a file that another process could not open by pathname, then pass that access through a Unix-domain socket. The receiving process gets a new file descriptor referring to the same kernel open-file state. No second pathname lookup is required, and the receiver’s ability to open that path is not re-evaluated as part of the transfer. That property makes SCM_RIGHTS more than an IPC convenience. It moves an already-established kernel capability across a process boundary. Security therefore depends on both sides of the exchange: the sender must constrain which descriptors can leave its authority domain, and the receiver must treat incoming descriptors as privileged objects whose properties require validation.

Cybersecurity Linux