gulaftab / redis

Automatically exported from code.google.com/p/redis
BSD 3-Clause "New" or "Revised" License
0 stars 0 forks source link

socket permissions are incorrect #475

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
2.2.1, Freebsd

Redis unix socket is created with permissions that don't allow applications, 
running from another user connect to it.

For exapmle redis installed from freebsd ports won't allow socket connections 
from apache / php / ...

Please chmod socket to 777 on creation.

This is exactly the same as this bug in MongoDB:
http://jira.mongodb.org/browse/SERVER-1774

Original issue reported on code.google.com by Glebu...@gmail.com on 3 Mar 2011 at 12:07

GoogleCodeExporter commented 9 years ago
It is recommended to use an instance per app, so why not run Redis as the same 
user as the app?

Original comment by pcnoordh...@gmail.com on 6 Mar 2011 at 3:32

GoogleCodeExporter commented 9 years ago
There are 2 cases:

1) one instance per app, only one user need access to the socket
2) one instance per "project", web/ftp/ssh/syslog/own programm/.. adds data 
into redis, web/.. has to read it (statistics/logs/data/..)

IMHO the only way to handle this two, is to have it configurable in redis.conf

It is a choice between security (configurable) and simplicity (default 777).

Original comment by nop...@gmail.com on 6 Mar 2011 at 6:22

GoogleCodeExporter commented 9 years ago
Problem is, on freebsd redis from ports is run from user "redis", so only root 
can use it's socket by default.

Configurable access would definately be nice (with 777 default).

I think you can definetely set socket to 777 when tcp/ip on 127.0.0.1 is 
enabled, as when it is - socket security doesn't matter as you can connect to 
redis with loopback anyway. (not considering firewall on loopback interface)

Original comment by Glebu...@gmail.com on 9 Mar 2011 at 2:25