Unix ___domain socket: Difference between revisions

Revision as of 19:48, 24 December 2020

Revision as of 15:53, 20 January 2021

Line 4:

| date = 30 April 2018

| title = Linux Programmer's Manual (unix - sockets for local interprocess communication)

| accessdateaccess-date = 22 February 2019

| df = dmy-all}}</ref>

* <code>SOCK_STREAM</code> (compare to [[Transmission Control Protocol|TCP]]) – for a stream-oriented socket

Line 13:

The [[API]] for Unix ___domain sockets is similar to that of an [[Internet socket]], but rather than using an underlying network protocol, all communication occurs entirely within the operating system [[Kernel (operating system)|kernel]]. Unix ___domain sockets may use the file system as their address [[name space]]. (Some operating systems, like Linux, offer additional namespaces.) Processes reference Unix ___domain sockets as file system [[inode]]s, so two processes can communicate by opening the same socket.

In addition to sending data, processes may send [[file descriptor]]s across a Unix ___domain socket connection using the <code>sendmsg()</code> and <code>recvmsg()</code> system calls. This allows the sending processes to grant the receiving process access to a file descriptor for which the receiving process otherwise does not have access.<ref name="neohapsis">{{cite web |url=http://archives.neohapsis.com/archives/postfix/2000-09/1476.html |date=30 September 2000 |title=Archive of the "Postfix Discussions" mailing list |accessdateaccess-date=29 September 2014 |archive-url=https://web.archive.org/web/20130518084034/http://archives.neohapsis.com/archives/postfix/2000-09/1476.html |archive-date=18 May 2013 |url-status=dead |df=dmy-all}}</ref><ref name="linux-cmsg-man-page">{{cite web |url=https://linux.die.net/man/3/cmsg |title=Linux man page - cmsg(3): access ancillary data |accessdateaccess-date=9 October 2018 |df=dmy-all}}</ref> This can be used to implement a rudimentary form of [[capability-based security]].<ref name="wheeler-secure-linux-howto">{{cite web |url=https://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/sockets.html |title="Secure Programming for Linux and Unix HOWTO", Section 3.4 "Sockets and Network Connections" |date=22 August 2004 |website=dwheeler.com |publisher=David A. Wheeler |accessdateaccess-date=29 September 2014}}</ref> For example, this allows the [[Clam AntiVirus]] scanner to run as an [[Privilege (computing)#Unix|unprivileged]] [[Daemon (computing)|daemon]] on Linux and BSD, yet still read any file sent to the daemon's Unix ___domain socket.

==See also==