Skip to content

Comment on Support HTTP over Unix domain socketsparent

Comments

What you say is only true if your firewall is configured to do so. By default (without any firewall), all traffic is exposed to every interface I believe.

EDIT: I stand corrected

This is not correct. Binding a socket to localhost (UDP, or TCP listener, or SCTP listener, ...) will prevent traffic from other network interfaces using it, even on the same machine.

    virtus ~ # nft list ruleset
    virtus ~ # nc -vvv -l -s 127.0.0.1 -p 1234
    Listening on localhost 1234



    virtus ~ # ip -4 addr show scope global dev enp3s0 
    2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
        inet 10.20.1.75/24 brd 10.20.1.255 scope global enp3s0
           valid_lft forever preferred_lft forever

    virtus ~ # nc -vvv 10.20.1.75 1234
    nc: connect to 10.20.1.75 port 1234 (tcp) failed: Connection refused


The security consideration with binding to localhost is that every process in the same network namespace can connect to that socket, regardless of what user the process is running as, unless you use netfilter to isolate what users can connect to where. Even then any process running as the given user will be permitted. A UNIX domain socket bound to a filesystem path can be constrained by filesystem ACLs and chroots, without having to touch netfilter at all.
AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.