yevgenko/cookbook-php-fpm — pull request #37 by brint (2014-05-01 15:44:24+00:00)
Title: Updating socket permissions

Setting the default socket listening permissions to `0660` as a security precaution. Leaving it set to `0666` can result in privilege escalation.

http://www.openwall.com/lists/oss-security/2014/04/29/5

> When using UNIX sockets, the socket's permissions default to 0666 if not
overriden explicitly ("listen.mode"). This is true even if the owner of
the socket is changed explicitly ("listen.user", "listen.group").

> Depending on the concrete scenario, this may result in privilege escalation.
Any local user with the ability to connect to UNIX sockets can run
arbitrary (PHP) code with the target process pool's permissions [1].