When a client connects over the proxy Unix Domain Socket, we must validate that it corresponds to a trusted client if the unixProxySocketCheckPermissions parameter is enabled. We may do this by inspecting its SO_PEERCRED object. A trusted client possesses the same UID as the Server, proving that it has access to the same on-disk secrets as the server.
We should reject all would-be clients of the proxy UDS.
- depends on
-
SERVER-117933 Implement a "proxy" unix domain socket
-
- Closed
-
-
-
- Closed
-
- is depended on by
-
SERVER-121216 Update proxyUnixSocketCheckPermissions parameter to check GID instead of UID
-
- Closed
-
- is duplicated by
-
-
- Closed
-
- related to
-
SERVER-121547 Proxy unix socket peer check fails to build on Mac
-
- Closed
-