An AF_UNIX socket, also called a Unix domain socket, is a local inter-process communication endpoint used by programs on the same host. Instead of sending data over TCP/IP, applications exchange messages through a file-system path or an abstract local address, which makes the channel fast and useful for trusted system services.
In cyber security, AF_UNIX sockets matter because they often front privileged daemons, agents, and control services. If untrusted code can reach the wrong socket, it may trigger admin actions, leak secrets, or bypass network-based defenses. Attackers look for path confusion, symlink tricks, or race conditions that redirect a sandboxed process to an unintended socket. Defenders should restrict socket exposure, validate paths after resolution, and isolate workspaces so that only approved local endpoints are reachable. In sandbox environments, a flawed socket relay can turn a local-only interface into a host-bound attack surface.