3 ms·
Isn't that the entire point of each socket living inside of a directory with privs / ACL protecting it?
by mjevans 2y ago
Isn't that the entire point of each socket living inside of a directory with privs / ACL protecting it?
- godelski 2y agoYeah that helps but it depends on the permission of the socket. You can make it harder to guess by changing control path. Here’s an article that talks about tmp[0]. But I mean if you wanted to be really secure you could use systemd nspawn and put each user into their own container[1] [0] https://salvatoresecurity.com/the-many-perils-of-tmp/ https://salvatoresecurity.com/the-many-perils-of-tmp/ [1] https://kilabit.info/journal/2022/chrooting_ssh_user_into_systemd-nspawn/ https://kilabit.info/journal/2022/chrooting_ssh_user_into_sy...