need advice: nginx php-fpm app level socket

[modnaruved]

Hi

I need some suggestion or advice.

I have application that run by nginx+php-fpm. From web server side script needs to access unix local socket (like /tmp/app/my.sock) with read and write permissions. From other side at shell level some my application create such socket (shell-app) and listen it with read write perms (because own it). Nginx + php-fpm by default is running under nobody:nobody so i cant access from web-server to this socket. When shell-app started I can chmod 0666 and web-app can access to it, but guess its not secure. I can also make some group app-sock and allow access nobody to this group but its seems incorrect. Finally I might run php-fpm under another account - not in nobody, but it seems insecure.

For some simple reason I want to use unix local socket /tmp/app/my.sock not tcp://0.0.0.0:2000

Is it possible be more secure with local socket with web application or not?
What do you think about secure solution for this case?

thanks

[lxg]

I'm afraid I don't completely understand your problem, but in cases like this, you may use a TCP connection on 127.0.0.1 (instead of 0.0.0.0, which usually means "all network devices"). This is just as secure as the local socket. You might even keep the 0.0.0.0 connection, and set up a firewall rule blocking the app's port (2000 in your example).
_________________
lxg.de – codebits and tech talk

[modnaruved]

[lxg]

I still have difficulties understanding what you're trying to do … but not so much because of your English, but rather because of your scenario.

Maybe what you're looking for is Setuid? Actually, mysqld.sock has the setuid bit. You could also set the sticky bit on the parent directory, which has a similar effect.

Of course, any interaction with your application via this socket must be checked for authorization by the application itself.
_________________
lxg.de – codebits and tech talk