Parameter · Connections and Authentication / Connection Settings
unix_socket_permissions
Sets the access permissions of the Unix-domain socket. Unix-domain sockets use the usual Unix file system permission set. The parameter value is expected to be a numeric mode specification in the form accepted by the chmod and umask system calls. (To use the customary octal format the number must start with a 0 (zero).)
- Default:
511 - Type: integer
- Range: 0 … 511
- Applies: Restart required
In plain words
The file permissions of the local socket. The default 0777 lets every local OS user attempt a connection (they still have to pass pg_hba.conf). 0770 limits it to the owner and the socket group, 0700 to the server user only.
For DBAs and operators
Specify the value in octal with a leading zero (0770); SHOW and pg_settings.setting print it in octal (0777), while pg_settings.boot_val shows the decimal 511. For sockets only the write bit matters, so 0770 and 0220 behave alike.
This check is done by the kernel when the client calls connect(); a denied user gets psql: error: connection to server on socket "/var/run/postgresql/.s.PGSQL.5432" failed: Permission denied and the server logs nothing. It is independent of, and in addition to, pg_hba.conf.
Some platforms ignore socket permissions (the docs name Solaris, as of Solaris 10); there, restrict the directory instead. Abstract-namespace sockets have no permissions at all. Typical hardening: unix_socket_group = 'pgclients', unix_socket_permissions = 0770, plus peer authentication for local lines.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then restart the server.