[Unit]
Description=PHP Cloudlinux SSA Agent Socket
PartOf=ssa-agent.service
[Socket]
ListenStream=/opt/alt/clos_ssa/run/ssa.sock
# SocketMode=0666 is intentional: the socket must be writable by PHP
# processes running under any web server (Apache, LiteSpeed, Nginx)
# across all supported panels (cPanel, Plesk, DirectAdmin).
# Restricting via SocketGroup is not feasible because the group owning
# PHP workers differs per panel and web server combination.
# Input validation in agent.py _validate_input() limits accepted payloads
# to the exact format produced by the C extension (7 fields with strict
# types). The world-writable mode does NOT by itself prevent cross-tenant
# metric spoofing; that guard lives in the authorization layer, not the
# socket ACL. SimpleAgent._authorize_sender() uses the kernel-trusted
# SO_PEERCRED UID together with the reported domain's PHP handler to fail
# CLOSED when a shared or service peer (nobody/apache, webapps, an unmapped
# UID) reports a per-user tenant's domain it does not own. Residual by
# design: a victim domain served under a shared handler (DSO/mod_php/Plesk
# module), or a panel whose handler API is unavailable (get_domains_php_info
# raises, e.g. InterWorx/ispmanager), cannot be told apart from legitimate
# shared-UID self-telemetry and is accepted. See
# docs/design/ssa-agent-socket.md.
SocketMode=0666
Backlog=2048
[Install]
WantedBy=sockets.target
|