Post #1103692
2026-04-09 16:08 UTC
@ska @lanodan
we don't auth it at all, and we open one socket per service
one socket per-service means we don't need to use cgroups to locate the service like systemd does, but since we have cgroups support, we could add authentication against the cgroup
except that would result on the same "race condition" wrt exiting, if the process exits and is reaped before the NOTIFY_SOCKET helper can auth-check it, then we can't auth-check it
so to implement permission control on our NOTIFY_SOCKET helper we would also need to implement BARRIER, :blep:
Replies (1)
-
@ska@social.treehouse.systems 2026-04-09 16:37
@navi@social.vlhl.dev @lanodan@queer.hacktivis.me If you have one socket per service with an unpredictable name, I don't think you need to authenticate at all. Only the right service knows the socket name, if the name is in a large enough space, you're good; it's all collaborative, if someone is trying to be malicious you have already lost. (You could verify via SO_PEERCRED that the client is root, though, if you want to be really safe.) s6-notify-socket-from-fd uses an abstract socket with autobind. The autobind address space is 2^20; that should be enough for the kernel to make the socket address unpredictable, and if not, 🤷