SO_PASSRIGHTS for Unix Domain Sockets

If you are using Unix Domain sockets on Linux, and you are not accepting file descriptors from these Unix Domain Sockets (which is the common case), you should probably disable the SO_PASSRIGHTS socket option to turn this feature off.

The underlying problem is: When SO_PASSRIGHTS is enabled, and a sender process sends a file descriptor using SCM_RIGHTS, it becomes part of the receiving process. If the recipient then does not actually read the file descriptor, the receiving process implicitly closes it. For most files this is fine, but it is possible to contruct degerate files which block for a long time when closing and which will block the receiver process during that time.

This is a man page extension which I proposed (ref):

SO_PASSRIGHTS (since Linux 6.16)

This socket option controls whether the socket accepts file descriptors from its peers in SCM_RIGHTS ancillary messages (see below). It is enabled by default. When it is disabled, sendmsg(2) calls that pass file descriptors to this socket fail with the error EPERM. The option is checked when the message is sent; disabling it does not affect messages that are already queued on the socket.

Processes that do not expect to receive file descriptors can disable this option. Once the file descriptors have been passed, closing them is the responsibility of the receiving process, and this may block for a long time, for example for a file on an unresponsive network file system.

The value given as an argument to setsockopt(2) and returned as the result of getsockopt(2) is an integer boolean flag.

At the moment, it does not look like this man page change will go through, so I’m posting it here instead.

Comments