MongoDB creates its unix domain socket in /tmp, which is work writable to anyone. Because an adversary could write its own socket to /tmp, clients should find a way to validate that they're connected to the right server.

It could do this by checking that the UID of the peer application is correct. But this would require the application to know MongoDB's UID.

Another way might be for mongod to create its unix domain socket in a location which is writable only by its UID. /run/mongod is probably the right location.

For on-prem installations from our RPMs/DPKGs, this would require some work in our installer to make sure that our system.d unit files have a RuntimeDirectory set. The Automation Agent would either need an alternative solution.