The clevis-pkcs11-afunix-socket-unlock daemon creates two AF_UNIX sockets (data socket at /run/systemd/clevis-pkcs11.sock and control socket at /run/systemd/clevis-pkcs11.control.sock) with no explicit permission restrictions and no peer credential verification. There is no umask(0077) before bind(), no fchmod() after bind(), and no SO_PEERCRED check on accepted connections.

The data socket delivers LUKS passphrases to connecting processes. The control socket accepts arbitrary device/key pair injections from connecting processes. Socket permissions depend entirely on the inherited process umask — under systemd's default UMask=0022, sockets get mode 0755 which prevents unprivileged connect() (write permission required for AF_UNIX stream sockets). However, in the dracut initramfs path or under a permissive umask, any process can connect and inject keys or receive passphrases.

The vulnerability is architectural: the code has zero authentication logic for its most critical function (key delivery), making the security posture entirely dependent on an inherited umask that is never verified in the code.

Affected files: src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c (control_thread and main socket handling)
Versions affected: >= v21 through v22 (latest)

Steps to reproduce:
1. Start the daemon under permissive umask: (umask 0000; clevis-pkcs11-afunix-socket-unlock -l /run/systemd/clevis-pkcs11-systemd.log -f /run/systemd/clevis-pkcs11.sock -s 60 &)
2. Verify socket permissions: stat -c '%a' /run/systemd/clevis-pkcs11.control.sock shows 777
3. As non-root user, inject a key: echo -n "target-device,INJECTED_KEY" | socat - UNIX-CONNECT:/run/systemd/clevis-pkcs11.control.sock
4. The injected key is accepted and logged — no peer credential check is performed.