sommerfeld: Note that permissions on the socket do not affect the ability of users to connect to it

Even though sometimes it seems like they do

danmcd: That does seem like a good plan

Especially now that so many of the clocks we use are computerised, with NTP and up to date timezone databases, etc

jclulow: while making this work, I definitely got permission denied errors which ppriv -l attributed to a zfs_*access function.

and changing the permissions fixed the issue.

It depends on whether the software is using xpg4 or native sockets, unfortunately

(as to whether we bother to do that access check)

that is, the _client_

ah, right, I see that now.

I locked down the containing directory as well.

Yeah, that's what we recommend