Add "-a perms" option to s6-ipcserver(-socketbinder)

4 files changed, 28 insertions, 8 deletions

diff --git a/doc/s6-ipcserver-socketbinder.html b/doc/s6-ipcserver-socketbinder.html
index 6a291fa..ce43d50 100644
--- a/doc/s6-ipcserver-socketbinder.html
+++ b/doc/s6-ipcserver-socketbinder.html
@@ -26,7 +26,7 @@ socket, then executes a program.
 <h2> Interface </h2>
 
 <pre>
-     s6-ipcserver-socketbinder [ -d | -D ] [ -b <em>backlog</em> ] [ -M | -m ] <em>path</em> <em>prog...</em>
+     s6-ipcserver-socketbinder [ -d | -D ] [ -b <em>backlog</em> ] [ -M | -m ] [ -a <em>perms</em> ] <em>path</em> <em>prog...</em>
 </pre>
 
 <ul>
@@ -59,6 +59,10 @@ the default. </li>
 that by default SOCK_DGRAM sockets are not connection-mode, and <tt>listen()</tt>
 will fail - so you should always give the <tt>-b0</tt> option to
 s6-ipcserver-socketbinder along with <tt>-m</tt>. </li>
+ <li> <tt>-a&nbsp;<em>perms</em></tt>&nbsp;: create the socket with
+permissions <em>perms</em>, which is an octal number from 0000 to 0777.
+Default is 0777, meaning everyone can connect to it. 0700 means only processes having the
+same uid as the s6-ipcserver-socketbinder process can connect to it. </li>
 </ul>
 
 <h2> Notes </h2>
diff --git a/doc/s6-ipcserver.html b/doc/s6-ipcserver.html
index 4d73db1..829febb 100644
--- a/doc/s6-ipcserver.html
+++ b/doc/s6-ipcserver.html
@@ -108,6 +108,10 @@ Default is 40. It is impossible to set it higher than <em>maxconn</em>. </li>
  <li> <tt>-b&nbsp;<em>backlog</em></tt>&nbsp;: set a maximum of
 <em>backlog</em> backlog connections on the socket. Extra
 connection attempts will rejected by the kernel. </li>
+ <li> <tt>-a&nbsp;<em>perms</em></tt>&nbsp;: create the socket with
+permissions <em>perms</em>, which is an octal number from 0000 to 0777.
+Default is 0777, meaning everyone can connect to it. 0700 means only processes having the
+same uid as the s6-ipcserver process can connect to it. </li>
  <li> <tt>-G&nbsp;<em>gidlist</em></tt>&nbsp;: change s6-ipcserver's
 supplementary group list to <em>gidlist</em> after binding the socket.
 This is only valid when run as root. <em>gidlist</em> must be a
diff --git a/src/conn-tools/s6-ipcserver-socketbinder.c b/src/conn-tools/s6-ipcserver-socketbinder.c
index 8215fa2..3bc6b52 100644
--- a/src/conn-tools/s6-ipcserver-socketbinder.c
+++ b/src/conn-tools/s6-ipcserver-socketbinder.c
@@ -9,7 +9,7 @@
 #include <skalibs/djbunix.h>
 #include <skalibs/webipc.h>
 
-#define USAGE "s6-ipcserver-socketbinder [ -d | -D ] [ -b backlog ] [ -M | -m ] path prog..."
+#define USAGE "s6-ipcserver-socketbinder [ -d | -D ] [ -b backlog ] [ -M | -m ] [ -a perms ] path prog..."
 #define dieusage() strerr_dieusage(100, USAGE)
 
 int main (int argc, char const *const *argv, char const *const *envp)
@@ -17,12 +17,13 @@ int main (int argc, char const *const *argv, char const *const *envp)
   unsigned int backlog = SOMAXCONN ;
   int flagreuse = 1 ;
   int flagdgram = 0 ;
+  unsigned int perms = 0777 ;
   PROG = "s6-ipcserver-socketbinder" ;
   {
     subgetopt_t l = SUBGETOPT_ZERO ;
     for (;;)
     {
-      int opt = subgetopt_r(argc, argv, "DdMmb:", &l) ;
+      int opt = subgetopt_r(argc, argv, "DdMmb:a:", &l) ;
       if (opt == -1) break ;
       switch (opt)
       {
@@ -31,6 +32,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
         case 'M' : flagdgram = 0 ; break ;
         case 'm' : flagdgram = 1 ; break ;
         case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ;
+        case 'a' : if (!uint0_oscan(l.arg, &perms)) dieusage() ; break ;
         default : dieusage() ;
       }
     }
@@ -40,7 +42,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
   close(0) ;
   if (flagdgram ? ipc_datagram() : ipc_stream()) strerr_diefu1sys(111, "create socket") ;
   {
-    mode_t m = umask(0) ;
+    mode_t m = umask(~perms & 0777) ;
     if ((flagreuse ? ipc_bind_reuse(0, argv[0]) : ipc_bind(0, argv[0])) < 0)
       strerr_diefu2sys(111, "bind to ", argv[0]) ;
     umask(m) ;
diff --git a/src/conn-tools/s6-ipcserver.c b/src/conn-tools/s6-ipcserver.c
index f259c15..03f6eb9 100644
--- a/src/conn-tools/s6-ipcserver.c
+++ b/src/conn-tools/s6-ipcserver.c
@@ -8,7 +8,7 @@
 #include <skalibs/djbunix.h>
 #include <s6/config.h>
 
-#define USAGE "s6-ipcserver [ -q | -Q | -v ] [ -d | -D ] [ -P | -p ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] path prog..."
+#define USAGE "s6-ipcserver [ -q | -Q | -v ] [ -d | -D ] [ -P | -p ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -a socketperms ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] path prog..."
 #define dieusage() strerr_dieusage(100, USAGE)
 
 int main (int argc, char const *const *argv, char const *const *envp)
@@ -25,12 +25,13 @@ int main (int argc, char const *const *argv, char const *const *envp)
   unsigned int maxconn = 0 ;
   unsigned int localmaxconn = 0 ;
   unsigned int backlog = (unsigned int)-1 ;
+  unsigned int socketperms = 0777 ;
   PROG = "s6-ipcserver" ;
   {
     subgetopt_t l = SUBGETOPT_ZERO ;
     for (;;)
     {
-      int opt = subgetopt_r(argc, argv, "qQvDd1UPpc:C:b:u:g:G:", &l) ;
+      int opt = subgetopt_r(argc, argv, "qQvDd1UPpc:C:b:a:u:g:G:", &l) ;
       if (opt == -1) break ;
       switch (opt)
       {
@@ -44,6 +45,7 @@ int main (int argc, char const *const *argv, char const *const *envp)
         case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; if (!maxconn) maxconn = 1 ; break ;
         case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; if (!localmaxconn) localmaxconn = 1 ; break ;
         case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ;
+        case 'a' : if (!uint0_oscan(l.arg, &socketperms)) dieusage() ; break ;
         case 'u' : if (!uid0_scan(l.arg, &uid)) dieusage() ; break ;
         case 'g' : if (!gid0_scan(l.arg, &gid)) dieusage() ; break ;
         case 'G' : if (!gid_scanlist(gids, NGROUPS_MAX, l.arg, &gidn) && *l.arg) dieusage() ; break ;
@@ -59,8 +61,8 @@ int main (int argc, char const *const *argv, char const *const *envp)
   {
     size_t pos = 0 ;
     unsigned int m = 0 ;
-    char fmt[UINT_FMT * 3 + UID_FMT + GID_FMT * (NGROUPS_MAX+1)] ;
-    char const *newargv[24 + argc] ;
+    char fmt[UINT_FMT * 3 + 5 + UID_FMT + GID_FMT * (NGROUPS_MAX+1)] ;
+    char const *newargv[26 + argc] ;
     newargv[m++] = S6_BINPREFIX "s6-ipcserver-socketbinder" ;
     if (!flagreuse) newargv[m++] = "-D" ;
     if (backlog != (unsigned int)-1)
@@ -71,6 +73,14 @@ int main (int argc, char const *const *argv, char const *const *envp)
       pos += uint_fmt(fmt + pos, backlog) ;
       fmt[pos++] = 0 ;
     }
+    if (socketperms != 0777)
+    {
+      newargv[m++] = "-a" ;
+      newargv[m++] = fmt + pos ;
+      fmt[pos++] = '0' ;
+      pos += uint_ofmt(fmt + pos, socketperms & 0777) ;
+      fmt[pos++] = 0 ;
+    }
     newargv[m++] = "--" ;
     newargv[m++] = *argv++ ;
     if (flagU || uid || gid || gidn != (size_t)-1)