DENY ALL ignored when using unix sockets

[Jevgeni Kiski]

HowTo reproduce:

Lets create a folder in /tmp with a file
mkdir /tmp/secure
echo 'My secret' > /tmp/secure/secret.txt

Then lets create a virtual server that listens to an unix socket:

server {
        server_name _;
        listen unix:/var/run/secure.sock;
        root /tmp/secure;

        deny all;

        location / {
                index index.html;
        }
}

Note: I also added deny all inside server block

in main server configuration we add proxy_pass to our newly created "secure" virtual server

location ^~ /secure/ {
  proxy_pass http://unix:/var/run/secure.sock:/;
}

reloading configuration and trying to access ​http://localhost/secure/secret.txt

We got contents! How? Deny all did not work

Expected:
403 Forbidden
Received:
200 OK with contents

Testing same thing but with ports:
Replacing sockets with ports:

server {
        server_name _;
        listen 8080;
        root /tmp/secure;

        deny all;

        location / {
                index index.html;
        }
}

And main server:

location ^~ /secure/ {
  proxy_pass http://0.0.0.0:8080/;
}

Reloading configuration and trying to access ​http://localhost/secure/secret.txt
403 Forbidden. As expected!

[Maxim Dounin]

Yes, the deny/allow directives are only able to work with IPv4 and IPv6 addresses. Support for unix socket clients should be added, see ​http://mailman.nginx.org/pipermail/nginx-devel/2013-May/003752.html.

[Jevgeni Kiski]

This looks like a security issue to me. It would be great to update documentation so people would know that access control is not supported for unix sockets. ​http://nginx.org/en/docs/http/ngx_http_access_module.html

[Ruslan Ermilov <ru@…>]

In 00dbfac67e48a8fe20802287b6fca50950178b8b/nginx:

Access: support for UNIX-domain client addresses (ticket #359).