jperezduerto.info
Security in depth · Unit 22 · Lesson 19 of 44
A local socket is still an access boundary
Separate permission to contact a local service from permission to change its policy.
Helpful before thisLinux privilege escalation
After this lesson you can
- Explain why socket access and authorization for a service operation are distinct checks.
Being allowed through the service door does not grant every action inside.
Connection and operation
A Unix-domain socket carries requests between local processes. On Linux, connecting to a pathname stream socket requires appropriate path access and write permission on the socket. This controls reaching the service, not the meaning of each request.
Abstract Unix sockets have no equivalent socket-file permission boundary. A service must use an appropriate client identity check and authorize sensitive operations; trusting a name supplied inside a request is not enough.
Supplied record: the library printer
This fictional Linux service uses a pathname stream socket. Its reviewed records say:
Parent directories: searchable by Lea.
Socket: permits connection by print-clients; Lea belongs to that group.
Identity check: the service uses trusted kernel peer credentials.
Action rules: print-clients may submit documents; only print-admins may change policy.
Lea: not a print-admin.
Assume the service correctly maps the authenticated identity to these roles and enforces the stated rules. Lea can connect and submit a document. Her policy-change request should be denied. These outcomes are compatible, not contradictory.
Describe the boundary precisely
Write a decision table for those two actions. Cite the socket permission for connection and the service rule for each operation. Do not translate the socket’s write permission into a general right to edit service settings.
The record describes this service and socket type only. It does not establish the behavior of an abstract socket or another daemon. A review of either needs its own identity and action rules, even on the same computer.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Lea can connect to the print socket. What follows for her request to change printer policy?
Show the answer
Correct answer: The service should deny that operation because her authenticated identity lacks the required role. The socket permits connection, while the service separately authorizes actions. Lea is a print client, not a print administrator.
Try it
- WriteWrite a two-row decision table for Lea: submit a document and change printer policy. State the expected outcome and which supplied permission or service rule supports it.