security_unix_may_send(9)

📦 version 7.3.1, in nixpkgs unstable

💅 security_unix_may_send(9) — Kernel API Manual ✨

okay so bestie, welcome to the security_unix_may_send(9) page from the Kernel API Manual. This is the vibe check for whether an AF_UNIX socket can send datagrams. lowkey iconic, no cap. 🫶

🌸 NAME 🌸

security_unix_may_send — Check if AF_UNIX socket can send datagrams. 💖

🎀 SYNOPSIS 🎀

int security_unix_may_send (struct socket *sock , struct socket *other
       );

🫶 ARGUMENTS 🫶

  • sock — originating sock. The main character socket, fr fr.
  • other — peer sock. The buddy on the other side. 💅

🦋 DESCRIPTION 🦋

Check permissions before connecting or sending datagrams from sock to other. That's the assignment, and it ate. ✨

The unix_stream_connect and unix_may_send hooks were necessary because Linux provides an alternative to the conventional file name space for Unix domain sockets. That's the lore, ngl. 📜

Whereas binding and connecting to sockets in the file name space is mediated by the typical file permissions (and caught by the mknod and permission hooks in inode_security_ops), binding and connecting to sockets in the abstract name space is completely unmediated. Not me saying that's a whole vibe — it's literally the situation. 😭

Sufficient control of Unix domain sockets in the abstract name space isn't possible using only the socket layer hooks, since we need to know the actual target socket, which is not looked up until we are inside the af_unix code. That's the reason, periodt. 💀

🔥 RETURN 🔥

Returns 0 if permission is granted. So 0 is the green-light moment — slay. ✅

👑 SEE ALSO 👑

Kernel file ./security/security.c — and okay bestie, here's the whole SEE ALSO guest list, every name exactly as written, iykyk: 🎀

xoxo, written in ./security, dated October 2026 — security_unix_may_send(9) out. 💖✨

📦 where this page comes from