Post #1103698
2026-04-09 16:37 UTC
@navi@social.vlhl.dev @lanodan@queer.hacktivis.me If you have one socket per service with an unpredictable name, I don't think you need to authenticate at all. Only the right service knows the socket name, if the name is in a large enough space, you're good; it's all collaborative, if someone is trying to be malicious you have already lost. (You could verify via SO_PEERCRED that the client is root, though, if you want to be really safe.)
s6-notify-socket-from-fd uses an abstract socket with autobind. The autobind address space is 2^20; that should be enough for the kernel to make the socket address unpredictable, and if not, 🤷
Replies (2)
-
@navi@social.vlhl.dev 2026-04-09 17:06
@ska @lanodan the name is predictable, but i can change that alright
-
@ada@zoner.work 2026-04-09 17:12
@ska@social.treehouse.systems @navi@social.vlhl.dev @lanodan@queer.hacktivis.me i low key disagree. just because if someone is trying to be malicious shouldn't automatically default to "you already lost." giving up acls in this case is just the security by obscurity fallacy, it's the entire reason why you should have it. the only thing that makes me coincide is that openrc sockets are extremely small and narrow surface so implementing it would likely just introduce even worse situations via bugs due to complexity