{"record":{"id":"817023a02dfd3b25","repo":"mono/mono","slug":"attach-disabled-listening-on-an-ipc-socket-when-r","errorCode":null,"errorMessage":"attach: disabled listening on an IPC socket when running in setuid mode.\n","messagePattern":"attach: disabled listening on an IPC socket when running in setuid mode\\.\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"mono/metadata/attach.c","lineNumber":357,"sourceCode":" *   Create a UNIX domain socket and bind it to a file in /tmp.\n *\n * SECURITY: This routine is _very_ security critical since we depend on the UNIX\n * permissions system to prevent attackers from connecting to the socket.\n */\nstatic void\nipc_connect (void)\n{\n\tstruct sockaddr_un name;\n\tint sock, res;\n\tsize_t size;\n\tchar *filename, *directory;\n\tstruct stat stat;\n\tstruct passwd pwbuf;\n\tchar buf [1024];\n\tstruct passwd *pw;\n\n\tif (getuid () != geteuid ()) {\n\t\tfprintf (stderr, \"attach: disabled listening on an IPC socket when running in setuid mode.\\n\");\n\t\treturn;\n\t}\n\n\t/* Create the socket.   */  \n\tsock = socket (PF_UNIX, SOCK_STREAM, 0);\n\tif (sock < 0) {\n\t\tperror (\"attach: failed to create IPC socket\");\n\t\treturn;\n\t}\n\n\t/* \n\t * For security reasons, create a directory to hold the listening socket,\n\t * since there is a race between bind () and chmod () below.\n\t */\n\t/* FIXME: Use TMP ? */\n\tpw = NULL;\n#ifdef HAVE_GETPWUID_R\n\tres = getpwuid_r (getuid (), &pwbuf, buf, sizeof (buf), &pw);","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/mono/mono/blob/0f53e9e151d92944cacab3e24ac359410c606df6/mono/metadata/attach.c#L339-L375","documentation":"During IPC setup for the attach/diagnostics transport, ipc_connect refuses to create or listen on a UNIX socket when the process is running setuid (getuid() != geteuid()). It prints the warning and returns immediately, disabling the IPC listener for security.","triggerScenarios":"Running a setuid-root (or any setuid) Mono process; getuid() != geteuid() at the time ipc_connect runs.","commonSituations":"Deploying Mono behind a setuid wrapper, running under sudo-as-setuid binaries, or hardening scripts that set the setuid bit on the mono executable.","solutions":["Run the process as a non-setuid binary if you need the attach/IPC transport.","Drop privileges (seteuid(getuid())) before Mono starts the IPC layer, if your security model allows it.","Accept that the attach mechanism is intentionally disabled in setuid mode and use other diagnostics channels (e.g. logging)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// In your launcher, detect setuid and either drop privileges or warn the user that attach is disabled:\n//   if (getuid() != geteuid()) {\n//       g_warning (\"attach IPC disabled in setuid mode; run non-setuid to enable\");\n//   }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid setuid Mono binaries when the attach transport is required.","Drop privileges before the runtime starts if your threat model permits."],"tags":["mono","attach","ipc","security","setuid"],"backgroundTag":null,"analyzedSha":"0f53e9e151d92944cacab3e24ac359410c606df6","analyzedAt":"2026-08-13T18:54:37.190Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}