Restricting Emacs server-mode socket access to a single user on a shared host

Answer the question first

1. Default directory permissions

• On modern Emacs (≥ 27), the server creates /tmp/emacs<UID> with mode 0700 and the socket file inside it with the same restrictive mode. This is hard‑coded in server.el and not affected by umask.
• Therefore, other local users cannot connect to your session unless they own the same UID or you explicitly change the permissions.

2. Moving the socket directory

• The variable server-socket-dir is fully supported. Setting it to a path such as $XDG_RUNTIME_DIR/emacs is the recommended way to keep the socket out of /tmp.
• However, emacsclient does not read your Emacs init file. To make the client connect to the new socket you must either:
  • Use --socket-name on the command line, e.g. emacsclient --socket-name=$XDG_RUNTIME_DIR/emacs/server.
  • Export the environment variable EMACS_SOCKET_NAME with the same value before invoking emacsclient.
• After changing server-socket-dir, restart the Emacs server (or restart the user session) so the new directory is created.

3. Side effects of chmod 700

• Keeping the socket directory at 0700 is harmless for desktop launchers, systemd user services, or any process that runs as your UID. Those services only need owner access.
• There are no known negative side effects; the default is already 0700, so an explicit chmod 700 is redundant.

Quick verification steps

1. Start the server: emacs --daemon.
2. Check permissions: ls -ld /tmp/emacs$(id -u) /tmp/emacs$(id -u)/server should show drwx------ and srwx------.
3. From another user: sudo -u otheruser emacsclient --socket-name=/tmp/emacs$(id -u)/server -e "(message \"test\")" → should fail with Permission denied.
4. Move socket: emacs --eval "(setq server-socket-dir \"$XDG_RUNTIME_DIR/emacs\")" --daemon.
5. Connect: EMACS_SOCKET_NAME=$XDG_RUNTIME_DIR/emacs/server emacsclient -e "(message \"ok\")" → should succeed.

What else might affect this?

These behaviors are consistent across recent Emacs releases, but if you are using a very old version (pre‑27) the directory may have been created with less restrictive defaults. If you encounter unexpected permission errors, check emacs --version and consult the NEWS entry for your release. Also ensure that /tmp/emacs<UID> does not already exist and is owned by another user, as Emacs will refuse to reuse it.

Next steps

With the default 0700 permissions and the optional relocation to $XDG_RUNTIME_DIR, your Emacs server socket is effectively single‑user on a shared host. No additional hardening is required unless you enable server-use-tcp, which exposes a network port and should be avoided for local‑only access.

Missing diagnostic detail

Could you confirm the exact Emacs version you are running? That will help verify the permission behavior.