security_uni...ream_connect(9)

💅 security_unix_stream_connect — Kernel API Manual

ok so bestie, welcome to the security_uni...ream_connect(9) page (yes the title got truncated in the header, she's mysterious like that ✨). This is the Kernel API Manual, and we're about to vibe-check a hook.

---

🌸 NAME 🌸

security_unix_stream_connect — check if a AF_UNIX stream is allowed 💖

---

✨ SYNOPSIS ✨

int security_unix_stream_connect (struct sock *sock , struct sock *other
, struct sock *newsk );

literally that's the whole signature, no notes 🫶

---

🎀 ARGUMENTS 🎀

• sock — the originating sock. like, where it all starts 👑
• other — the peer sock. the one on the other end of the line 🦋
• newsk — the new sock. brand new, fresh out the box 🍓

---

💜 DESCRIPTION 💜

Bestie. Listen. This one's whole job is to check permissions before you go establishing a Unix domain stream connection between sock and other. Gatekeeping, but make it security 🔥

ok so why does this hook even exist?? The unix_stream_connect and unix_may_send hooks were necessary because Linux provides an alternative to the conventional file name space for Unix domain sockets. (i know. two name spaces. it's giving overachiever.)

Here's the tea ☕:

• Binding and connecting to sockets in the file name space is mediated by the typical file permissions — and that's caught by the mknod and permission hooks in inode_security_ops.
• Binding and connecting to sockets in the abstract name space is completely unmediated. no cap, zero checks, absolutely feral 💀

So sufficient control of Unix domain sockets in the abstract name space isn't possible using only the socket layer hooks, since we need to know the actual target socket, which is not looked up until we are inside the af_unix code. like, we can't judge her before we've even met her 🙈

---

⭐ RETURN ⭐

Returns 0 if permission is granted. that's it, that's the whole mood 💅

---

🌈 SEE ALSO 🌈

First up, the kernel file herself: ./security/security.c — and then literally the entire extended friend group:

lsm_file_alloc(9), lsm_backing_file_alloc(9), lsm_blob_alloc(9), lsm_cred_alloc(9), lsm_inode_alloc(9), lsm_task_alloc(9), lsm_ipc_alloc(9), lsm_key_alloc(9), lsm_msg_msg_alloc(9), lsm_bdev_alloc(9), lsm_bpf_map_alloc(9), lsm_bpf_prog_alloc(9), lsm_bpf_token_alloc(9), lsm_superblock_alloc(9), lsm_fill_user_ctx(9), security_binder_set_context_mgr(9), security_binder_transaction(9), security_binder_transfer_binder(9), security_binder_transfer_file(9), security_ptrace_access_check(9), security_ptrace_traceme(9), security_capget(9), security_capset(9), security_capable(9), security_quotactl(9), security_quota_on(9), security_syslog(9), security_settime64(9), security_vm_enough_memory_mm(9), security_bprm_creds_for_exec(9), security_bprm_creds_from_file(9), security_bprm_check(9), security_bprm_committing_creds(9), security_bprm_committed_creds(9), security_fs_context_submount(9), security_fs_context_dup(9), security_fs_context_parse_param(9), security_sb_alloc(9), security_sb_delete(9), security_sb_free(9), security_free_mnt_opts(9), security_sb_eat_lsm_opts(9), security_sb_mnt_opts_compat(9), security_sb_remount(9), security_sb_kern_mount(9), security_sb_show_options(9), security_sb_statfs(9), security_sb_mount(9), security_sb_umount(9), security_sb_pivotroot(9), security_sb_set_mnt_opts(9), security_sb_clone_mnt_opts(9), security_move_mount(9), security_path_notify(9), security_inode_alloc(9), security_inode_free(9), security_dentry_init_security(9), security_dentry_create_files_as(9), security_inode_init_security(9), security_inode_init_security_anon(9), security_path_mknod(9), security_path_post_mknod(9), security_path_mkdir(9), security_path_rmdir(9), security_path_unlink(9), security_path_symlink(9), security_path_link(9), security_path_rename(9), security_path_truncate(9), security_path_chmod(9), security_path_chown(9), security_path_chroot(9), security_inode_create(9), security_inode_post_create_tmpfile(9), security_inode_link(9), security_inode_unlink(9), security_inode_symlink(9), security_inode_mkdir(9), security_inode_rmdir(9), security_inode_mknod(9), security_inode_rename(9), security_inode_readlink(9), security_inode_follow_link(9), security_inode_permission(9), security_inode_setattr(9), security_inode_post_setattr(9), security_inode_getattr(9), security_inode_setxattr(9), security_inode_set_acl(9), security_inode_post_set_acl(9), security_inode_get_acl(9), security_inode_remove_acl(9), security_inode_post_remove_acl(9), security_inode_post_setxattr(9), security_inode_getxattr(9), security_inode_listxattr(9), security_inode_removexattr(9), security_inode_post_removexattr(9), security_inode_file_setattr(9), security_inode_file_getattr(9), security_inode_need_killpriv(9), security_inode_killpriv(9), security_inode_getsecurity(9), security_inode_setsecurity(9), security_inode_listsecurity(9), security_inode_getlsmprop(9), security_inode_copy_up(9), security_inode_copy_up_xattr(9), security_inode_setintegrity(9), security_kernfs_init_security(9), security_file_permission(9), security_file_alloc(9), security_file_release(9), security_file_free(9), security_backing_file_alloc(9), security_backing_file_free(9), security_file_ioctl(9), security_file_ioctl_compat(9), security_mmap_file(9), security_mmap_backing_file(9), security_mmap_addr(9), security_file_mprotect(9), security_file_lock(9), security_file_fcntl(9), security_file_set_fowner(9), security_file_send_sigiotask(9), security_file_receive(9), security_file_open(9), security_file_post_open(9), security_file_truncate(9), security_task_alloc(9), security_task_free(9), security_cred_alloc_blank(9), security_cred_free(9), security_prepare_creds(9), security_transfer_creds(9), security_cred_getsecid(9), security_cred_getlsmprop(9), security_kernel_act_as(9), security_kernel_create_files_as(9), security_kernel_module_request(9), security_kernel_read_file(9), security_kernel_post_read_file(9), security_kernel_load_data(9), security_kernel_post_load_data(9), security_task_fix_setuid(9), security_task_fix_setgid(9), security_task_fix_setgroups(9), security_task_setpgid(9), security_task_getpgid(9), security_task_getsid(9), security_current_getlsmprop_subj(9), security_task_getlsmprop_obj(9), security_task_setnice(9), security_task_setioprio(9), security_task_getioprio(9), security_task_prlimit(9), security_task_setrlimit(9), security_task_setscheduler(9), security_task_getscheduler(9), security_task_movememory(9), security_task_kill(9), security_task_prctl(9), security_task_to_inode(9), security_create_user_ns(9), security_ipc_permission(9), security_ipc_getlsmprop(9), security_msg_msg_alloc(9), security_msg_msg_free(9), security_msg_queue_alloc(9), security_msg_queue_free(9), security_msg_queue_associate(9), security_msg_queue_msgctl(9), security_msg_queue_msgsnd(9), security_msg_queue_msgrcv(9), security_shm_alloc(9), security_shm_free(9), security_shm_associate(9), security_shm_shmctl(9), security_shm_shmat(9), security_sem_alloc(9), security_sem_free(9), security_sem_associate(9), security_sem_semctl(9), security_sem_semop(9), security_d_instantiate(9), security_getselfattr(9), security_setselfattr(9), security_getprocattr(9), security_setprocattr(9), security_ismaclabel(9), security_secid_to_secctx(9), security_lsmprop_to_secctx(9), security_secctx_to_secid(9), security_release_secctx(9), security_inode_invalidate_secctx(9), security_inode_notifysecctx(9), security_inode_setsecctx(9), security_inode_getsecctx(9), security_post_notification(9), security_watch_key(9), security_netlink_send(9), security_unix_may_send(9), security_socket_create(9), security_socket_post_create(9), security_socket_socketpair(9), security_socket_bind(9), security_socket_connect(9), security_socket_listen(9), security_socket_accept(9), security_socket_sendmsg(9), security_socket_recvmsg(9), security_socket_getsockname(9), security_socket_getpeername(9), security_socket_getsockopt(9), security_socket_setsockopt(9), security_socket_shutdown(9), security_sock_rcv_skb(9), security_socket_getpeersec_stream(9), security_socket_getpeersec_dgram(9), lsm_sock_alloc(9), security_sk_alloc(9), security_sk_free(9), security_sk_clone(9), security_sk_classify_flow(9), security_req_classify_flow(9), security_sock_graft(9), security_inet_conn_request(9), security_inet_csk_clone(9), security_inet_conn_established(9), security_secmark_relabel_packet(9), security_secmark_refcount_inc(9), security_secmark_refcount_dec(9), security_tun_dev_alloc_security(9), security_tun_dev_free_security(9), security_tun_dev_create(9), security_tun_dev_attach_queue(9), security_tun_dev_attach(9), security_tun_dev_open(9), security_sctp_assoc_request(9), security_sctp_bind_connect(9), security_sctp_sk_clone(9), security_sctp_assoc_established(9), security_mptcp_add_subflow(9), security_unix_find(9), security_ib_pkey_access(9), security_ib_endport_manage_subnet(9), security_ib_alloc_security(9), security_ib_free_security(9), security_xfrm_policy_alloc(9), security_xfrm_policy_clone(9), security_xfrm_policy_free(9), security_xfrm_policy_delete(9), security_xfrm_state_alloc(9), security_xfrm_state_alloc_acquire(9), security_xfrm_state_delete(9), security_xfrm_state_free(9), security_xfrm_policy_lookup(9), security_xfrm_state_pol_flow_match(9), security_xfrm_decode_session(9), security_key_alloc(9), security_key_free(9), security_key_permission(9), security_key_getsecurity(9), security_key_post_create_or_update(9), security_audit_rule_init(9), security_audit_rule_known(9), security_audit_rule_free(9), security_audit_rule_match(9), security_bpf(9), security_bpf_map(9), security_bpf_prog(9), security_bpf_map_create(9), security_bpf_prog_load(9), security_bpf_token_create(9), security_bpf_token_cmd(9), security_bpf_token_capable(9), security_bpf_map_free(9), security_bpf_prog_free(9), security_bpf_token_free(9), security_locked_down(9), security_bdev_alloc(9), security_bdev_free(9), security_bdev_setintegrity(9), security_perf_event_open(9), security_perf_event_alloc(9), security_perf_event_free(9), security_perf_event_read(9), security_perf_event_write(9), security_uring_override_creds(9), security_uring_sqpoll(9), security_uring_cmd(9), security_uring_allowed(9), security_initramfs_populated(9)

ok that's the whole list, i checked twice, every single one is there. go read them all bestie, i believe in you 🫶💖

---

and that's the page!! brought to you by the ./security girlies, dated October 2026, signing off with the truncated icon herself — security_uni...ream_connect(9). slay, stay mediated 💅✨