unix_socket_permissions

Definition PG 18 manual

Sets the access permissions of the Unix-domain socket(s). Unix-domain sockets use the usual Unix file system permission set. The parameter value is expected to be a numeric mode specified in the format accepted by the chmod and umask system calls. (To use the customary octal format the number must start with a 0 (zero).)

The default permissions are 0777, meaning anyone can connect. Reasonable alternatives are 0770 (only user and group, see also unix_socket_group) and 0700 (only user). (Note that for a Unix-domain socket, only write permission matters, so there is no point in setting or revoking read or execute permissions.)

This access control mechanism is independent of the one described in Chapter 20.

This parameter can only be set at server start.

This parameter is irrelevant on systems, notably Solaris as of Solaris 10, that ignore socket permissions entirely. There, one can achieve a similar effect by pointing unix_socket_directories to a directory having search permission limited to the desired audience.

Sockets in the abstract namespace have no file permissions, so this setting is also ignored in that case.

How it works

unix_socket_permissions sets the chmod-style mode of filesystem Unix-domain sockets. Use a leading zero for octal notation. For a socket, only the write bit controls the ability to connect; read and execute bits do not provide meaningful additional socket access.

It is a POSTMASTER-context setting, so the mode changes only when sockets are recreated at server restart. Directory traversal permissions and unix_socket_group can form another local boundary, while pg_hba.conf local records still authenticate database users independently.

Abstract-namespace sockets have no filesystem permissions, so this setting is ignored for @-prefixed socket entries. Some operating systems also ignore socket modes entirely; the page must not present the mode as a portable replacement for directory permissions or pg_hba.conf.

Operational considerations

Writing decimal 770 instead of octal 0770 and creating an unintended numeric mode.

Expecting read or execute bits to control socket connection access; only the write bit matters.

Relying on the mode for abstract-namespace sockets or operating systems that ignore socket permissions.

Treating a restrictive socket mode as a substitute for pg_hba.conf authentication, role privileges, or directory traversal controls.

Workload guidance

OLAP: Apply the same local policy to analytical tools. Do not weaken the mode to solve a missing group or directory deployment; repair the operating-system identity path instead.

OLTP: Use 0770 or 0700 only when local operating-system membership is an intentional first boundary, and verify that directory permissions and pg_hba.conf still enforce the desired policy. The portable default 0777 can be acceptable when pg_hba.conf is authoritative.

SMALL: Choose the simplest mode supported by the platform and test it after restart. For abstract sockets or systems that ignore socket modes, enforce access through the directory choice where applicable and pg_hba.conf.