SSSD 2.9.0 Release Notes
Highlights
General information
sss_simpleifp
library is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using--with-libsifp
./configure
option.“Files provider” (i.e.
id_provider = files
) is deprecated and might be removed in further releases. Those who are interested to keep using it awhile should configure its build explicitly using--with-files-provider
./configure
option. Or consider using “Proxy provider” withproxy_lib_name = files
instead.Previously deprecated
--enable-files-domain
configure option, which was used to manage default value of theenable_files_domain
config option, is now removed.Long time unused ‘–enable-all-experimental-features’ configure option was removed.
SSSD will no longer warn about changed defaults when using
ldap_schema = rfc2307
and default autofs mapping. This warning was introduced in 1.14 to loudly warn about different default values.
New features
New passkey functionality, which will allow the use of FIDO2 compliant devices to authenticate a centrally managed user locally. Moreover, in the case of a FreeIPA user, it can also issue a Kerberos ticket automatically with upcoming FreeIPA version 4.11.
Add support for ldapi:// URLs to allow connections to local LDAP servers
NSS IDMAP has two new methods:
getsidbyusername
andgetsidbygroupname
Note: support for passkey is in its initial phase and the authentication policy will be adjusted in future versions.
Packaging changes for passkey
Include passkey subpackage and dependency for libfido2.
Configuration changes for passkey
New options to enable and tune passkey behavior:
pam_passkey_auth
,ldap_user_passkey
,passkey_verification
,passkey_child_timeout
,interactive
,interactive_prompt
,touch
andtouch_prompt
.--with-passkey
is a new configuration option to enable building passkey authentication.
Important fixes
A regression when running sss_cache when no SSSD domain is enabled would produce a syslog critical message was fixed.
Configuration changes
Default value of
cache_first
option was changed totrue
in case SSSD is built withoutfiles provider
.ipa_access_order parameter introduced. It behaves much like ldap_access_order but affects IPA domains (id_provider = ipa) and accepts limited values. Please see sssd-ipa(5) for more information.
Tickets Fixed
#5390 - sssd failing to register dynamic DNS addresses against an AD server due to unnecessary DNS search
#6383 - sssd is not waiting for network-online.target
#6403 - Add new Active Directory related certificate mapping templates
#6404 - [RFE] Add digest mapping feature from pam_pkcs11 in SSSD
#6451 - UPN check cannot be disabled explicitly but requires krb5_validate = false’ as a work-around
#6479 - Smart Card auth does not work with p11_uri (with-smartcard-required)
#5080 - [RFE] - Show password expiration warning when IdM users login with SSH keys
#5390 - sssd failing to register dynamic DNS addresses against an AD server due to unnecessary DNS search
#6228 - Enable passkey authentication in a centralized environment
#6324 - coredump occurs when I restart sssd-ifp.service with sssd.service is inactive
#6357 - KCM erroneously changes primary cache when renewing credentials
#6360 - [D-Bus] ListByName() returns several times the same entry
#6361 - [D-Bus] ListByName() fails when not using wildcards
#6383 - sssd is not waiting for network-online.target
#6387 - Fatal errors in log during Anaconda installation: “CRIT sss_cache:No domains configured, fatal error!”
#6398 - [D-Bus] Groups.ListByName() and Groups.ListByDomainAndName() not working
#6403 - Add new Active Directory related certificate mapping templates
#6404 - [RFE] Add digest mapping feature from pam_pkcs11 in SSSD
#6451 - UPN check cannot be disabled explicitly but requires krb5_validate = false’ as a work-around
#6465 - SBUS:A core dump occurs when
dbus_server_get_address()
#6477 - changing password with ldap_password_policy = shadow does not take effect immediately
#6479 - Smart Card auth does not work with p11_uri (with-smartcard-required)
#6487 - implicit declaration of function
fgetpwent
in test_negcache_2.c#6505 - SSS_CLIENT: general library destructor should cancel thread-at-exit destructors
#6531 - FAST/OTP with Anonymous PKINIT - oddly requires a keytab to exist (can be a bogus keytab)
#6544 - AD: Nested group processing can fail or return invalid members (security issue)
#6548 - sssd-ipa
#6551 - passkey_child cannot be used to register passkey due to too strict permissions
#6558 - enabling passkey authentication breaks idp support
#6565 - Improvement: sss_client: add ‘getsidbyusername()’ and ‘getsidbygroupname()’ and corresponding python bindings
#6588 - Integration Tests:The
sssd_hosts
module is missing in release tarball#6592 - pid wrapping caused sss_cli_check_socket to close the file descriptor opened by the process
#6600 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
#6610 - BUILD: Clear compilation alarms.
#6612 - MIT Kerberos confusion over password expiry
#6617 - filter_groups doesn’t filter GID from ‘id’ output: AD + ‘ldap_id_mapping = True’ corner case
#6626 - Unable to lookup AD user from child domain (or “make filtering of the domains more configurable”)
#6635 - sss allows extraneous @ characters prefixed to username
Detailed Changelog
$ git shortlog --pretty=format:"%h %s" -w0,4 2.8.0..2.9.0
Alejandro López (36):
2070000a3 CACHE_REQ: Do not use timestamp optimization on "files" provider.
214540e72 Cache: String has to be duplicated instead of copied
719c92533 CACHE_REQ: Initialize domain with NULL
8f7c35eae CACHE_REQ: Do not return duplicated values.
a97962826 TESTS: Correct ListByAttr()'s test
569dca5f2 CACHE_REQ: Consider the domain when looking names in the cache
09895561a TESTS: New test for D-Bus' ListByName()
c3453e4e8 CACHE_REQ: Use a const struct in cache_req_data_create()
36e5479b2 BUILD: Fix some warnings thrown while building
34d55884c BACKEND: Reload resolv.conf after initialization
0da99b73e SDAP: Fixed header file
11dab864e PAM: Localize some forgotten words.
475052a29 LDAP: Moved and renamed set_access_rules()
ae74a9d1f IPA: Add password expiration warning when using ssh keys
be84d6ee8 PAM: Warn that the password has expired when using ssh keys
ede02a201 MAN: Cosmetic changes to sssd-ldap.5
cfd71fec6 MONITOR: Move the file monitoring code to util.
d4e574475 TESTS: Add a test for file-watch
e1c0af26e MAN PAGES: Make try_inotify dependent on HAVE_INOTIFY.
fadd8eb6c BACKEND: Move resolv.conf watching to the backends
2e3fa180d D-BUS: Remove resInit() method from sssd.services
c97d92754 FILE WATCH: Get rid of parent_ctx
729c1fc2d FILE WATCH: Simplify watching on missing files.
fe67123cc CONFIG-CHECK: Extracted code checking 'inherit_from'
1911ad64f CONFIG-CHECK: Function always returns EOK
255d9f6e8 CHECK-CONFIG: id_provider is now mandatory
f604d033f TESTS: Test mandatory id_provider
f283248ff CONFIG-CHECK: inherit_from is not a typo
55e27a423 KCM: Switch default caches only when there is no current default.
cfc591d65 SDAP: Include struct ldb_dn in struct sdap_search_base
84e7dbc9b SDAP: Ignore the cn=views entries in nested groups
9e9d5825d Tests: Test that cn=views is ignored.
54aabca0b UTIL: Introduicing SPRItime
3463caa82 COVERITY: Remove several Y2K38_SAFETY warnings
3b65d7be5 COVERITY: Resolve a WRITE_CONST_FIELD warning
c3d6cc9a3 AD: Do not use the shortcut when filter_groups is set.
Alexander Bokovoy (2):
9724f871a passkey: only accept the client realm as relaying party ID
d0a6bf606 passkey: implement realm check for the passkey challenge
Alexey Tikhonov (48):
a5403f789 IPA: "trusted user not found" isn't an error
8a2fd06b2 CFG RULES: allow 'fallback_to_nss' option
71466a8db SYSDB: pre-existence of MPG group in the cache isn't an error
3e02de933 UTILS: socket connect: added missing new line and adjusted log level to more appropriate
25eae1c08 SYSDB: use `sss_strerror()` to handle `ERR_GID_DUPLICATED`
93ed5e58e UTILS: got rid of deprecated `inet_netof()` to please 'rpminspect'.
6ef3aade0 TOOLS: don't export internal helpers
7af46ba0e TOOLS: fixed handling of init error
99791400b SSSCTL: don't require 'root' for "analyze" cmd
d4d9aa654 SSSCTL: don't require 'root' for "passkey-exec" cmd
e4dd11f2c SYSDB: pre-existence of MPG group in the cache isn't an error
8b09c9387 Translations: add missing `tools/sssctl/sssctl_cert.c` and macros
714ababe8 BUILD: deprecate `--enable-files-domain` build option
293264509 SBUS: don't call `dbus_server_get_address(NULL)`
4e600d9b9 Added a number of missing new lines.
b631c3174 MAN: mention `attributes` in 'see also'
08ccd23fb SSS_CLIENT: delete key in lib destructor
501e05f46 BUILD: remove `--enable-files-domain` build option
6b048a6a1 INTG TESTS: make `get_call_output()` respect `check` arg for Python < 3.7
6ffd46d11 MAN: remove "experimental" notice off LDAP access control based on NDS attributes.
aa5c0c9c0 BUILD: remove long time unused '--enable-all-experimental-features'
0b8638d8d SSS_CLIENT: fix error codes returned by common read/write/check helpers.
ef93284b5 SSS_CLIENT: if poll() returns POLLNVAL then socket is alredy closed (or wasn't open) so it shouldn't be closed again. Otherwise there is a risk to close "foreign" socket opened in another thread.
bf3f73ea0 PAM_SSS: close(sss_cli_sd) should also be protected with mutex. Otherwise a thread calling pam_end() can close socket mid pam transaction in another thread.
4e6540052 PAM: removed outdated comment
c55bb3976 Use `is_files_provider()` helper where possible.
8e75bb611 RESPONDERS: get rid of `NEED_CHECK_PROVIDER` helper
d4f7ed69d MONITOR: fix `socket_activated` flag initialization
9f8e71152 MAN: describe security risk of `cache_credentials`
2ce24d38d UTILS: missing domain in `sss_parse_name()` input isn't SSSDBG_CONF_SETTINGS
f5787878e NSS: empty result of `..._group_by_origgid()` isn't an error
e5fba8f97 TESTS: fix compilation issue with musl libc
7356881cd SDAP: removed leftovers after 65bd6bf05d75c843e525f8bf89e9b75b02a2bfb7
a9bc94f0e INTG-TESTS: add missing files to Makefile.am
067cc5cce BUILD: make "files provider" build configurable
978ef1794 UTILS: force inline `is_files_provider()`
c53390a83 DP: warn loudly if config uses 'files' when support wasn't built
8962eaca5 INTG-TESTS: enable '--with-files-provider'
132fb4016 Deprecate 'sss_simpleifp' library.
c586b9a28 RESPONDERS: delete obsolete 'responder_sbus.h'
437dbe9e1 MONITOR: currently only 'ifp' doesn't support running as non-root
e2106c946 SUDO: fix mistype
5159992d7 RESPONDER: use safe helper
64424963a UTILS: sanitize `cli_creds_get_*` macro
ae691f0b4 NSS: change default value of 'cache_first' to 'true'
ddec8ae2d SPEC: obsolete libsss_simpleifp
9bf55bf9a MONITOR: disable 'user' config option in case --with-sssd-user=root
8b94af6ef MONITOR: validate value of 'user' option.
Cole Robinson (1):
340691fae MAN: Fix option typo on sssd-kcm.8
Dan Lavu (4):
419b9b8f6 Adding Ported DynDNS Testcases
7caf2da3c Fixing dyndns tests
53c8e8f07 Removing unnecessary restart unnecessary restart
9aece27dd Adding ptr zone creation to class setup
David Härdeman (1):
96a0e9fbe LDAP: Handle MIT LDAP KDB password expiry
Florence Blanc-Renaud (1):
718afc297 Passkey: flush stdout
Gioele Barabucci (1):
47f82a418 Makefile: Install dbus policy in /usr, not /etc
HelloCarry (1):
42594c375 fix sysvol_gpt_version may be used uninitialized
Iker Pedrosa (23):
7a1976c94 fido2: register key with helper process
9a2548ea0 fido2: make the build conditional
f800471e2 sssd.supp: suppress leak errors
8bdcc0287 passkey: change fido2 to passkey
f24b6daa9 passkey: replace erroneous description
28124cfbd passkey: print PEM formatted public key
ab6910ae0 passkey: verify assertion
2b0a8f275 passkey: public key in PEM format
6b0d175f8 passkey: input PIN via stdin
336b1facd ci: fix codeql
723872f3e CI: remove flake8 action
927fa8433 passkey: register discoverable credentials
62654e254 passkey: user id for discoverable credentials
bd02f6378 passkey: fix uninitialized variable
30daa0ccd spec: update to include passkey
92d1b4699 passkey: move select authenticator
bccdc2af2 passkey: obtain assertion data
f77ec4f50 passkey: verify assertion data
8218634df passkey: replace printf by PRINT
dae5367b6 test: cast to `char *` assert_string_equal() args
a41810bdf CI: store CodeQL configuration artifacts
f97cd4d4f passkey: don't print User ID
619ecbbc6 test: add conditional build for passkey functions
Jakub Vavra (26):
a21c66625 Tests: Add a test for bz1964121 override homedir to lowercase
a7759ab30 Tests: Add the missing admisc pytest marker.
bce2b0c80 Tests: Wait a bit before collection log in test_0015_ad_parameters_ad_hostname_machine.
d7e7efe93 Tests: Fix E126 in test_adparameters_ported.py
14748ff98 Tests: Update fixture using adcli to handle password from stdin.
fc3fad982 Tests: Fix automount OU removal from AD.
153b1c913 Tests: Add mark tier1_4 so pytest is not throwing warnings.
c4ea28511 Tests: Move some less important scenarios from tier 1 to tier 2.
067c550cf Tests: Test for bz2144491 UPN mismatch
708a924a1 Tests: Changes to the version handling and fixture create_testdir.
32a8b9538 Tests: Optimize winhost properties
fc4f0399b Tests: Fix incorrect distro parsing in qe_class on Fedora.
97e040f98 Tests: Set cryptopolicy for master for AD fips tests.
9145544fd Tests: Add a remedy for a missing multihost_dir.
1c55f0d4c Tests: Refactor join ad.
80d28babb Tests: Make sure that session_multihost.ad is always available.
f46fe473c Tests: Skip test_0002_ad_parameters_junk_domain on multiarch
9e061fc06 Tests: Remove keytab on realm leave.
bc5de6868 Tests: Add a timeout to realm join for AD, modify realm leave.
255c01a1c Tests: Fix error in cifs tests.
325fc8e13 Tests: Improve stability of tests in TestADParamsPorted, remove un-needed backups.
30e0b472a Tests: Add tests for BZ1765354
9329c09dc Tests: Fix pytest markers to remove warnings.
04cc2f73c Tests: Install libsss_simpleifp conditionally based on release.
d735fb1e4 Tests: Ignore chattr result on resolv.conf
ed2510d91 Tests: Add test for bz1913839 gid of filtered group gid still present in id
Justin Stephenson (32):
5b27a353a Fido2 child: Add missing options
ab89455be CI: Build srpm fix for illegal version tag '-'
6d87af5ef SSSCTL: Add passkey exec command
ee0d73a2c SSSCTL: Use wrapper function for analyze
4c678cbb4 Analyzer: Optimize list verbose output
bfa8d50c4 Analyzer: Ensure parsed id contains digit
2f99cd31b SSSCTL: Add debug option to help message
4a6eb258c CI: Update core github actions
4138b0a73 MAN: ldap_group_name enhancement with nested groups
fb5a300b4 passkey: Add configuration options
fbbe9ba3f authtok: Add Passkey type
57152761b Add new option ldap_user_passkey
3f24aa71f Extend IPA config search
ec6774930 Add DNS Domain name to struct sss_domain_info
ea9bcab65 IPA Retrieve passkey configuration
b92ff263c PAM: Call the passkey helper binary
7f8fe3994 Support Passkey prompting config
64f98463a Tests: Passkey (Pre)auth
938676a37 Tests: Passkey prompting config
64aa2672e PAM: Add destructor for passkey pin
5a22aefbc PAM: Covscan NULL check for cache req result domain
50a3a1911 Passkey: Use correct User verification comparison
745379bc4 SSSCTL: Switch passkey-exec to passkey-register
cdfe2c515 Authtok: Support SSS_AUTHTOK_TYPE_PASSKEY{_REPLY}
5de070f94 pam_sss: Add passkey kerberos preauth support
7c34742c4 krb5_child: Add passkey kerberos preauth support
c76ba343b PAM: Passkey kerberos preauth support
9869e4875 krb5_child: Increase child buffer and chunk size
88f4d3cf7 Passkey: Add util function to prefix passkey data
1032ca21d MAN: Clarify user_verification will be overwritten
bb21171b7 Passkey: Changes to debug_libfido2 option
5744bad7d Tests: Amend PAM Preauth tests
Luke Dickinson (1):
d48669405 Remove the need for a keytab when using fast with anonymous pkinit
MCJ Vasseur (1):
02bdef7d7 Fix typo (pasword -> password)
Madhuri Upadhye (3):
81eb0606d Tests: Minor fixes for alltests
576a1c19a Tests: Automation of bug, bz2100789, which test id_provider parameter from domain section
c200fc019 Test: Test nested group in view based search
Pavel Březina (35):
6a2de710b Update version in version.m4 to track the next release
b38fdc818 confdb: avoid syslog message when no domains are enabled
4da861368 monitor: read all enabled domains in add_implicit_services
64c22dd1c sss_cache: use ERR_NO_DOMAIN_ENABLED instead of ENOENT
df55b1f16 confdb: chande debug level when no domain are found in confdb_get_domains
103a48887 autofs: do not yield warning on default configuratoin
62458d490 ci: enable ci for sssd-2-8 branch
c526acbae ci: switch to actions/checkout@v3
770bf7bf3 ci: use GITHUB_OUTPUT instead of set-output
b2d193b93 ci: switch to actions/upload-artifact@v3
a22af6f00 pot: update translations
f5c0e7b39 ci: make /dev/shm writable
ae614c17b ci: install correct python development package
c6053c431 pot: update pot files
f43d8c9a0 ci: increase timeout for covscan
7e8b97c14 ldap: update shadow last change in sysdb as well
c0b394ab2 sudo: skip smart refresh if it happens inside full refresh
59d2f945e fix missing new line in sss_iface.c and docstrings.rst
f44e58642 tests: fix all flake8 issues
bd803bf6b nssidmap: add getsidbyusername and getsidbygroupname
712377ea5 tests: add system tests using pytest-mh framework
ce81f017f tests: include requirements.txt in system tests documentation requirements
df7a5c33a tests: build systen tests documentation in readthedocs
62cb54dc2 tests: make pytest-ldap aware of TLS options
ad68d71c3 passkey: add Kerberos plugins
2a16c2563 idp: switch to common API for radius-style plugin
a5efc5e63 tests: fix type errors due to type enhancements in jc
3d0fcca3c tests: avoid list() and dict() as default parameter value
a825b28b1 passkey: fix copyrights and comments in krb plugin
e794bfdea ci: prepend pr copr build with high version number
c3a0b5f07 tests: split system test framework into standalone repository
559f29ffb tests: load fixtures from sssd-test-framework
52c3d6c2d tests: create data directory in system tests
e91b5d4ad man: put sssd_user_name.include to builddir
6c184c476 pot: update pot files
Sargun Narula (6):
2bd0c249b Tests: Ported Bash-krb-access-provider to pytest
61f1b8937 Tests: Ported Bash-krb-fast-principal to pytest
61d6030b1 Added entry for krb_access_provider in readme.rst
9fd8da284 Fixed domainname value in krb_ldap_connection
821455c7c Tests: Ported cache_performance testing cases to pytest
6d659e29e Fixed docstring minor changes
SargunNarula (1):
34f1c222c Reused sssdTools Instance
Shridhar Gadekar (14):
a05719fab Tests: Porting the AD-Access-control test-suite to pytest
92347d98f Tests: GSSAPI ssh login failing due to a missing directive
955192b12 Tests: gssapi ssh login minor fix
607723063 Tests: Use negative cache better for lookup by SIDs
664a436e9 Test: gssapi test fix
24a536638 Tests: port bash idmap testcase to pytest
ddd85f95d Tests: change tier of dyndns tests
2fa80dbd2 Dropping idmap
42842c16a TESTS: bz2110091 sssd starting offline after reboot
8cda19e28 Tests: bz2128840 automation
4e9c2fdbe TESTS: clean up group delete fix
d249154c0 Test: porting of failing rfc2307bis testcase
a75557b73 Test: porting bash range_retrieval to pytest
265f6e028 Tests: sss allows extraneous @ characters prefixed to username
Steeve Goveas (1):
790e7a779 Tests: Cannot SSH with AD user to ipa-client with invalid keytab
Sumit Bose (23):
91789449b PAC: allow to disable UPN check
b3d7a4f6d ipa: do not add guessed principal to the cache
51b11db8b pac: relax default check
3f8bc8720 certmap: add support for serial number
10d977a36 certamp: add support for subject key id
9e1b711b2 certmap: add support for SID extension
f293507d9 certmap: fix for SAN URI
c4085c9a7 certmap: add bin_to_hex() helper function
11483f1ec sssctl: add cert-eval-rule sub-command
3676a4fba certmap: add get_digest_list() and get_hash()
0a9061073 certmap: dump new attributes in sss_cert_dump_content()
1303c6241 certmap: add LDAPU1 mapping rules
4ac53fb5e certmap: add tests for new attributes and LDAPU1 rules
882f560e6 certmap: add LDAPU1 rules to man page
b0bdf712e certmap: Add documentation for some internal functions
aac303e84 p11: fix size of argument array
7fb89ab01 passkey: do not copy more than received
6ba0187e1 certmap: fix to handle ediPartyName
ced32c44e certmap: Handle type change of x400Address
ebc1e460e krb5: add joined/parent domain to [domain_realm]
def571ba4 krb5: make sure realm is known when writing domain_realms
9358a74d3 ad: skip filtering if ad_enabled_domains is set
1bf475140 tests: fix typo in ldapi test
Timotej Lazar (1):
e623fac7e tests: use echo instead of /bin/echo in Makefile
Tomas Halman (4):
2fda8e7b7 RESOLV: Configuration option for DNS search
087845363 cfg_rules.ini update
526aea3e8 util: Improve re_expression defaults
b78b508b1 responder: regexp cleanup
Weblate (4):
ba5439c0f po: update translations
80690213f po: update translations
7c5dd8783 po: update translations
ede8c1392 po: update translations
aborah (15):
76c7fa463 Tests: make corresponding tests capture SSSD logs
a5176f4d9 Tests: SSSD: `sssctl analyze` command shouldn't require 'root' privileged
5021d2394 Tests: Fix minor error in root privilage test
7a68ed1f6 Tests: Fix ipa tests wrong ipa_client_ip
13d420ca7 Tests: Fix test test_0017_filesldap
3dfc82a05 Tests: Fix subidranges test
66687d8c2 Tests: Port bz785908 and bz785898
173d0867f Tests: Port Thread issue can cause the application to not get any identity information bz847043
97c671e4a Tests: Port automount bash tests to pytest
cc0545b4e Tests: Port Bash Password Policy to pytest
c6db359fa Tests: Fix restore work for ipa test
b3c681a7b Tests: Port bash inmemory_cache test suit to pytest
9c17615a7 Tests: don't fail if chattr file doesn't exist
08711256a Tests: Add missing package
eb4941541 Tests: Add support for ldapi:// URLs
aborah-sudo (6):
6c0ae779f Tests: port proxy_provider/rfc2307
dab19a4d6 Tests: Removing tests from gating pipe line
7c907a7c9 Tests: Removing tests from gating pipe line
285f17031 Tests: fix test_bz1368467
ad0a8c6a3 Tests: fix test_sssctl_local.py::Testsssctl::test_0002_bz1599207
4a658e6cc Tests: port proxy_provider/rfc2307bis
answer9030 (2):
0e25f0d19 Fixed pid wrapping in sss_cli_check_socket
5c363bfbf Fixed the problem of calling getpid() and lstat() twice in sss_cli_check_socket()
bluikko (1):
5c83deb5d src/util/domain_info_utils.c: fix typo
minfrin (6):
9f2d8d691 Add support for ldapi:// URLs.
f22134181 Align sockaddr_storage to sockaddr for updated API.
91b701232 Ensure we touch sockaddr_len in the success case only.
4ccd5b9ac Do not set SO_KEEPALIVE on AF_UNIX.
2d54cf5eb Rename sdap_get_server_ip_str() to sdap_get_server_peer_str()
e004595ae Don't force TLS on if we're a unix domain socket.