The key trick: use memset() to zero out the entire sockaddr_un structure (which sets sun_path[0] to \0), then copy your abstract name starting from sun_path[1].

#include <sys/socket.h>
#include <sys/un.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    struct sockaddr_un addr;
    int sockfd;

    /* Step 1: Create a UNIX domain stream socket */
    sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
    if (sockfd == -1) { perror("socket"); exit(1); }

    /*
     * Step 2: Prepare the abstract address.
     *
     * memset to 0 sets sun_path[0] = '\0'.
     * This null byte at position 0 signals to the kernel:
     * "this is an abstract socket, not a file path".
     */
    memset(&addr, 0, sizeof(struct sockaddr_un));
    addr.sun_family = AF_UNIX;

    /*
     * sun_path[0] is already '\0' from memset.
     * Copy abstract name starting from sun_path[1].
     * sizeof - 2 leaves room for the leading '\0' and avoids overflow.
     */
    strncpy(&addr.sun_path[1], "xyz", sizeof(addr.sun_path) - 2);

    /*
     * The abstract name is now:
     * sun_path = [ \0, 'x', 'y', 'z', \0, \0, \0, ... ]
     *              ^                   ^
     *              |                   null bytes (not part of name)
     *              signals abstract
     */

    if (bind(sockfd, (struct sockaddr *) &addr,
             sizeof(struct sockaddr_un)) == -1) {
        perror("bind");
        exit(1);
    }

    printf("Abstract socket bound to name: \\0xyz\n");
    printf("No file was created in the filesystem.\n");

    /* When sockfd is closed, the abstract name disappears automatically */
    close(sockfd);
    exit(EXIT_SUCCESS);
}

For conventional socket paths, the name is a null-terminated C string. The kernel reads bytes until it hits a \0.

For abstract sockets, the name is not null-terminated. The kernel reads all the remaining bytes in sun_path after the leading \0, including embedded nulls. This is sometimes called a binary name.

If a pointer named name accidentally points to an empty string ("", i.e., name[0] == '\0'), and you do:

strncpy(addr.sun_path, name, sizeof(addr.sun_path) - 1);

Then sun_path[0] gets set to \0, and the subsequent bind() creates an abstract socket — even though you intended to use a normal path! On Linux this silently succeeds. On other UNIX systems, bind() would correctly fail with an error.

if (strlen(sock_path) == 0) {
    fprintf(stderr, "Error: socket path cannot be empty!\n");
    exit(1);
}
strncpy(addr.sun_path, sock_path, sizeof(addr.sun_path) - 1);

Connecting to an abstract socket works exactly the same way as creating one: use a null byte at position 0 and the same name in the remaining bytes.

#include <sys/socket.h>
#include <sys/un.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>

int connect_to_abstract_socket(const char *name)
{
    struct sockaddr_un addr;
    int sockfd;

    sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
    if (sockfd == -1) { perror("socket"); return -1; }

    /*
     * Build the abstract address the same way as the server did.
     * The leading '\0' + name must match exactly.
     */
    memset(&addr, 0, sizeof(struct sockaddr_un));
    addr.sun_family = AF_UNIX;
    strncpy(&addr.sun_path[1], name, sizeof(addr.sun_path) - 2);

    if (connect(sockfd, (struct sockaddr *) &addr,
                sizeof(struct sockaddr_un)) == -1) {
        perror("connect");
        close(sockfd);
        return -1;
    }

    printf("Connected to abstract socket: \\0%s\n", name);
    return sockfd;
}

int main(void)
{
    int fd = connect_to_abstract_socket("xyz");
    if (fd != -1) {
        /* Use the connected socket ... */
        close(fd);
    }
    return 0;
}

Since abstract sockets have no file system path, you cannot see them with ls. Use the ss command (socket statistics) instead:

# List all UNIX domain sockets including abstract ones
$ ss -xl

# or with netstat (older systems)
$ netstat -x

# Abstract sockets show as @name (the '@' represents the null byte)
# Example output:
# Netid  State    Local Address     Peer Address
# u_str  LISTEN   @xyz              *
#                 ^
#                 @ = abstract (null byte at position 0)

Several well-known Linux systems use abstract sockets: