Repository navigation
Set permissions/ownership when creating a socket #94984
Description
Feature or enhancement
When creating a socket with one of the asyncio methods, it should be possible to specify the correct ownership/permissions needed for good security.
Pitch
When creating a server with loop.create_unix_server(), it will create the socket with default permissions which may lack security or may not be accessible to the application that is meant to communicate via this socket.
Previous discussion
Activity
kumaraditya303 commentedon Sep 30, 2022
Can't you do this by calling
os.chmodafter binding the socket?Dreamsorcerer commentedon Sep 30, 2022
Yes, see the original (archived) issue linked.
The behaviour is not desirable, and could potentially lead to security issues. If you can create a file with the correct permissions, why would you not be able to create a named socket with the correct permissions?
e.g. os.open allows setting the permissions on creation: https://docs.python.org/3/library/os.html#os.open
gvanrossum commentedon Sep 30, 2022
Possibly because there's no platform-independent way to do it? (I think I gleaned this from the original issue.)
Anyway, I'd be happy to review a PR, but I'm not the expert here. @Dreamsorcerer are you interested in submitting a PR?
Dreamsorcerer commentedon Sep 30, 2022
Not currently, got a hundred things to catch up on with aiohttp etc. Mainly just wanted to make sure the request didn't get lost. Maybe I'll get some time to come back to it at some point though.
gvanrossum commentedon Oct 1, 2022
No worries, hopefully someone else with relevant knowledge will help us out.
kumaraditya303 commentedon Jul 27, 2026
@Dreamsorcerer Do you still want to pursue this further?
Dreamsorcerer commentedon Jul 27, 2026
How do you feel about the os.chmod() proposal in the original issue? If we add the call between the bind() and listen(), then any connections before the permissions are set would be refused anyway, so that likely minimises the security implications.
kumaraditya303 commentedon Aug 1, 2026
Yeah, that sounds good to me.
gh-94984: Add mode parameter to asyncio create_unix_server() (#155086)
pythongh-94984: Add mode parameter to asyncio create_unix_server() (p…