jetty-unixsocket: No ability to set permissions on unix domain socket - other services cannot connect
- Dominant language
- Java
- Stars
- 4.1k
- Forks
- 2k
- Avg merge
- 3d 56m
- Merged PRs (30d)
- 48
Description
**Jetty version(s)**
Jetty 10+
**Jetty Environment**
**Java version/vendor** `(use: java -version)`
openjdk version "17.0.9" 2023-10-17 LTS
OpenJDK Runtime Environment (Red_Hat-17.0.9.0.9-1) (build 17.0.9+9-LTS)
OpenJDK 64-Bit Server VM (Red_Hat-17.0.9.0.9-1) (build 17.0.9+9-LTS, mixed mode, sharing)
**OS type/version**
RHEL9
**Description**
When a unix domain socket is created, the socket is created given the umask of the server. This in almost all cases creates a socket that can only be connected to by the same user that runs jetty.
```
[root@seawitch ~]# ls -al /tmp/jenkins.socket
srwxr-xr-x. 1 jenkins jenkins 0 Nov 6 22:08 /tmp/jenkins.socket
```
This breaks the privilege separation between components.
The workaround is to change the umask to 0002 or 0007, but this has the side effect that it gives full application write access to the entity connecting to the socket.
The permissions on the socket need to be configurable. No need to overthink the difference between unix and windows, if "allow anyone to connect" is allowed, the admin is given the option to put the sock in a directory protected as they need it.
**How to reproduce?**
Create a jenkins instance with unix domain socket support. See the permissions on the socket.
Contributor guide
Research direction
Start by reproducing the unix domain socket behavior with Jetty 10+ on Java 17 and RHEL9, then trace the existing unix domain socket support. Done means socket permissions are configurable without relying on the server umask, and the resulting socket permits the intended service connection without granting unintended write access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- networking
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100