Documentation
¶
Overview ¶
Package uds creates per-user Unix domain socket listeners with dotvault's owner-only permission invariant.
dotvault serves two independent surfaces over a Unix socket — the SSH agent (internal/agent) and the local API socket (internal/web) — and both carry live credential material: the agent signs with keys derived from the Vault token, and the API socket hands out the Vault token itself. The bind sequence that keeps them owner-only is fiddly enough (0700 parent, stale socket detection that must not clobber a live instance, bind-then-chmod rather than a umask swap) that having two copies would let them drift. This package is the single implementation.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrAlreadyListening = errors.New("another process is already listening on the socket")
ErrAlreadyListening is returned by Listen when a live process is already accepting connections on the requested path. Callers wrap it with a message naming their own surface ("dotvault agent already running at …") — the remedy differs per surface, but the detection must not.
var ErrUnsupported = errors.New("unix domain sockets are not supported on this platform")
ErrUnsupported is returned by Listen on platforms where dotvault does not serve Unix domain sockets (Windows, which uses named pipes instead).
Functions ¶
func Cleanup ¶
func Cleanup(path string)
Cleanup removes the socket file. net.UnixListener.Close already unlinks it in the common case; this is a best-effort backstop for the paths it doesn't cover (e.g. a bind that failed after creating the node).
func Listen ¶
Listen creates a Unix domain socket at path with 0600 permissions inside a 0700 parent directory, creating the directory if needed.
A socket left behind by an unclean shutdown is removed first — but only after confirming no live instance answers on it, so a second daemon can never clobber a running one's socket. When one does answer, Listen returns an error wrapping ErrAlreadyListening so callers can report it in their own vocabulary.
Permissions are a hard invariant, not a nicety: whoever can connect can borrow the Vault token (API socket) or have the agent sign for them. The bind is followed immediately by an explicit chmod rather than a process-global umask swap (syscall.Umask), which would apply to every file any other daemon goroutine creates during the bind window — the sync engine writing a managed file, the state store saving — giving them unexpectedly tight modes. The brief moment the socket sits at the default-umask mode before the chmod lands is closed by the 0700 parent: no other user can traverse into it to reach the socket, whatever the socket's own bits are.
Types ¶
This section is empty.
Source Files