Report: Unix Sockets
A unix domain socket (UDS), or unix socket, is an interprocess communication (IPC) mechanism that enables bidirectional data exchange among multiple processes running on the same host.
A unix socket may be a STREAM (analagous to TCP), a DATAGRAM (analagous to UDP), SEQPACKET (sequenced packet, analagous to SCTP), or RAW. Unix sockets commonly use the file system as their address name space, so processes refer to them as file system inodes, so two processes can communicate by opening the same socket.
Note
It is important to not conflate Unix sockets with network sockets. Network sockets are generally used to enable the exchange of data over the network, but they can also be used to achieve IPC by using the loopback interface (localhost). Unix sockets are only for interprocess communication, and can be secured using file system permissions, while TCP sockets can be secured only on the packet filter level.
Report Data: Unix Sockets
Following are the unix sockets present at the time the memory snapshot was taken of the centos 6 - 2.6.32-696.28.1.el6.x86_64 image from the samples gallery (requires authentication).
The following table describes each column of the reported data.
Column | Description | Notes |
---|---|---|
Pid | ID of the parent process | |
Process Name | Name of the parent process | |
Socket Type | Socket type: STREAM, DATAGRAM, SEQPACKET, RAW | |
Socket State | ||
Reference Count | ||
Name | Socket name, if defined | |
Inode | Unique integer that identifes the socket | Linux and Unix sockets are implemented with filesystem semantics |
Forensic Hints
The same set of unix sockets can be obtained from a running Linux
system via the netstat -l -p
or ss -x -a
commands; any difference
between the set (a) read from usermode and (b) derived from memory inspection
should be investigated, as discussed here.