When postgres runs on Linux, applications can connect to postgresql through an unix-domain socket or using a tcp-ip connection to postgres. This all happens behind the scenes. Postgres has parameters that control where these sockets are created and who can access postgresql sockets.
In this blog, we will look at three parameters: unix_socket_directories, unix_socket_group, and unix_socket_permissions.
We will check the values of unix_socket_directories, unix_socket_group, and unix_socket_permissions using SHOW and pg_settings. Then, we will inspect the files that the postgres creates in the socket directory.
show unix_socket_directories ;
Result :
unix_socket_directories
-------------------------
/var/run/postgresql
(1 row)
Check this parameter’s metadata from pg_settings like this.
select * from pg_settings where name = 'unix_socket_directories';
Result :
-[ RECORD 1 ]---+----------------------------------------------------------------
name | unix_socket_directories
setting | /var/run/postgresql
unit |
category | Connections and Authentication / Connection Settings
short_desc | Sets the directories where Unix-domain sockets will be created.
extra_desc |
context | postmaster
vartype | string
source | configuration file
min_val |
max_val |
enumvals |
boot_val | /var/run/postgresql
reset_val | /var/run/postgresql
sourcefile | /etc/postgresql/18/main/postgresql.conf
sourceline | 68
pending_restart | f
Let’s see what is inside the unix socket directories.
Move to the directory.
cd /var/run/postgresql
Check the contents inside this folder using this bash command.
ls
Result :
14-main.pg_stat_tmp 17-main.pid 18-main.pid
14-main.pid 18-main2.pid pgbouncer.pid
See what is inside this PID file.
cat 18-main.pid
Result :
1206
This is the actual process ID of the running postgres based on this unix socket directories.
Check the complete metadata based on this process ID like this.
ps -p 1206 -f
Result :
UID PID PPID C STIME TTY TIME CMD
postgres 1206 1 0 21:25 ? 00:00:00 /usr/lib/postgresql/18/bin/postgres -D /var/lib/postgresql/18/main -c config_file=/etc/postgresql/18/main/postgresql.conf
Now, we can see that the postgres process ID is 1206, and it shows the binary path of postgres and also the data directory, including the path of the postrgres.conf file like this.
show unix_socket_group;
Result :
-[ RECORD 1 ]-----+-
unix_socket_group |
Check this parameter’s metadata from pg_settings like this.
select * from pg_settings where name = 'unix_socket_group';
Result :
-[ RECORD 1 ]---+-----------------------------------------------------------------------------------------------------------------------------
name | unix_socket_group
setting |
unit |
category | Connections and Authentication / Connection Settings
short_desc | Sets the owning group of the Unix-domain socket.
extra_desc | The owning user of the socket is always the user that starts the server. An empty string means use the user's default group.
context | postmaster
vartype | string
source | default
min_val |
max_val |
enumvals |
boot_val |
reset_val |
sourcefile |
sourceline |
pending_restart | f
The parameter named unix_socket_group controls the operating-system group that owns Postgresql’s Unix-domain socket. By default, the parameter is empty. In this case, postgres uses the default group of the operating-system user that starts the postgresql server. The socket owner is always the user running the postgres server. This parameter can be used to give a specific OS group access to the postgres Unix socket. It is useful when multiple local users need to connect to PostgreSQL.
show unix_socket_permissions;
Result :
-[ RECORD 1 ]-----------+-----
unix_socket_permissions | 0777
Check this parameter’s metadata from pg_settings like this.
select * from pg_settings where name = 'unix_socket_permissions';
Result :
-[ RECORD 1 ]---+----------------------------------------------------------------------
name | unix_socket_permissions
setting | 0777
unit |
category | Connections and Authentication / Connection Settings
short_desc | Sets the access permissions of the Unix-domain socket.
extra_desc | Unix-domain sockets use the usual Unix file system permission set. The parameter value is expected to be a numeric mode specification in the form accepted by the chmod and umask system calls. (To use the customary octal format the number must start with a 0 (zero).)
context | postmaster
vartype | integer
source | default
min_val | 0
max_val | 511
enumvals |
boot_val | 511
reset_val | 511
sourcefile |
sourceline |
pending_restart | f
The unix_socket_permissions setting is what determines the access permissions for the postgres unix-domain socket. This is how you decide who can use the socket. It is based on the Linux file permissions. You can set the value as a code like 0777 or 0770. Normally, postgres uses 0777 for this setting. You can change unix_socket_permissions to restrict access to the unix_socket_permissions when you need to. This helps control who can use the unix_socket_permissions.
Unix domain sockets are really important for postgres connections on Linux. Three things control how these sockets work: unix_socket_directories, which says where the sockets are made, unix_socket_group, which says who owns them, and unix_socket_permissions, which says who can use them.
If you look at these things using SHOW and pg_settings and then check the files and the postgres process, you can see how postgres uses the Linux file system for connections. These settings are also helpful when you want to decide which local users and groups can get to postgres using unix domain sockets.