jetty / jetty/jetty.project

jetty-unixsocket: No ability to set permissions on unix domain socket - other services cannot connect

Open
#10,860 17 comments 0 reactions 0 assignees View on GitHub
Bug Help Wanted Stale
Dominant language
Java
Stars
4.1k
Forks
2k
Avg merge
3d 56m
Merged PRs (30d)
48

Description

**Jetty version(s)**

Jetty 10+

**Jetty Environment**

**Java version/vendor** `(use: java -version)`

openjdk version "17.0.9" 2023-10-17 LTS
OpenJDK Runtime Environment (Red_Hat-17.0.9.0.9-1) (build 17.0.9+9-LTS)
OpenJDK 64-Bit Server VM (Red_Hat-17.0.9.0.9-1) (build 17.0.9+9-LTS, mixed mode, sharing)

**OS type/version**

RHEL9

**Description**

When a unix domain socket is created, the socket is created given the umask of the server. This in almost all cases creates a socket that can only be connected to by the same user that runs jetty.

```
[root@seawitch ~]# ls -al /tmp/jenkins.socket
srwxr-xr-x. 1 jenkins jenkins 0 Nov 6 22:08 /tmp/jenkins.socket
```

This breaks the privilege separation between components.

The workaround is to change the umask to 0002 or 0007, but this has the side effect that it gives full application write access to the entity connecting to the socket.

The permissions on the socket need to be configurable. No need to overthink the difference between unix and windows, if "allow anyone to connect" is allowed, the admin is given the option to put the sock in a directory protected as they need it.

**How to reproduce?**

Create a jenkins instance with unix domain socket support. See the permissions on the socket.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the unix domain socket behavior with Jetty 10+ on Java 17 and RHEL9, then trace the existing unix domain socket support. Done means socket permissions are configurable without relying on the server umask, and the resulting socket permits the intended service connection without granting unintended write access.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
networking
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.