Move Unix domain utilities and access control utilites,

as well as the accessrules library, from s6-networking to here

25 files changed, 1901 insertions, 0 deletions

diff --git a/src/conn-tools/deps-exe/s6-accessrules-cdb-from-fs b/src/conn-tools/deps-exe/s6-accessrules-cdb-from-fs
new file mode 100644
index 0000000..e027835
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-accessrules-cdb-from-fs
@@ -0,0 +1,3 @@
+-lskarnet
+${SOCKET_LIB}
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-accessrules-fs-from-cdb b/src/conn-tools/deps-exe/s6-accessrules-fs-from-cdb
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-accessrules-fs-from-cdb
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-connlimit b/src/conn-tools/deps-exe/s6-connlimit
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-connlimit
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-ioconnect b/src/conn-tools/deps-exe/s6-ioconnect
new file mode 100644
index 0000000..e027835
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ioconnect
@@ -0,0 +1,3 @@
+-lskarnet
+${SOCKET_LIB}
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-ipcclient b/src/conn-tools/deps-exe/s6-ipcclient
new file mode 100644
index 0000000..19869b2
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ipcclient
@@ -0,0 +1,2 @@
+-lskarnet
+${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-ipcserver b/src/conn-tools/deps-exe/s6-ipcserver
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ipcserver
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-ipcserver-access b/src/conn-tools/deps-exe/s6-ipcserver-access
new file mode 100644
index 0000000..bfcb622
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ipcserver-access
@@ -0,0 +1,3 @@
+${LIBS6}
+-lskarnet
+${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-ipcserver-socketbinder b/src/conn-tools/deps-exe/s6-ipcserver-socketbinder
new file mode 100644
index 0000000..19869b2
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ipcserver-socketbinder
@@ -0,0 +1,2 @@
+-lskarnet
+${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-ipcserverd b/src/conn-tools/deps-exe/s6-ipcserverd
new file mode 100644
index 0000000..19869b2
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-ipcserverd
@@ -0,0 +1,2 @@
+-lskarnet
+${SOCKET_LIB}
diff --git a/src/conn-tools/deps-exe/s6-sudo b/src/conn-tools/deps-exe/s6-sudo
new file mode 100644
index 0000000..e7187fe
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-sudo
@@ -0,0 +1 @@
+-lskarnet
diff --git a/src/conn-tools/deps-exe/s6-sudoc b/src/conn-tools/deps-exe/s6-sudoc
new file mode 100644
index 0000000..e027835
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-sudoc
@@ -0,0 +1,3 @@
+-lskarnet
+${SOCKET_LIB}
+${TAINNOW_LIB}
diff --git a/src/conn-tools/deps-exe/s6-sudod b/src/conn-tools/deps-exe/s6-sudod
new file mode 100644
index 0000000..e027835
--- /dev/null
+++ b/src/conn-tools/deps-exe/s6-sudod
@@ -0,0 +1,3 @@
+-lskarnet
+${SOCKET_LIB}
+${TAINNOW_LIB}
diff --git a/src/conn-tools/s6-accessrules-cdb-from-fs.c b/src/conn-tools/s6-accessrules-cdb-from-fs.c
new file mode 100644
index 0000000..20fef4d
--- /dev/null
+++ b/src/conn-tools/s6-accessrules-cdb-from-fs.c
@@ -0,0 +1,195 @@
+/* ISC license. */
+
+#include <unistd.h>
+#include <errno.h>
+#include <stdio.h>  /* for rename() */
+#include <skalibs/bytestr.h>
+#include <skalibs/uint16.h>
+#include <skalibs/fmtscan.h>
+#include <skalibs/cdb_make.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/stralloc.h>
+#include <skalibs/direntry.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/skamisc.h>
+#include <skalibs/random.h>
+
+#define USAGE "s6-accessrules-cdb-from-fs cdbfile dir"
+
+static stralloc tmp = STRALLOC_ZERO ;
+
+static void cleanup (void)
+{
+  register int e = errno ;
+  unlink(tmp.s) ;
+  errno = e ;
+}
+
+static void dienomem (void)
+{
+  cleanup() ;
+  strerr_diefu1sys(111, "stralloc_catb") ;
+}
+
+static void doit (struct cdb_make *c, stralloc *sa, unsigned int start)
+{
+  unsigned int tmpbase = tmp.len ;
+  unsigned int k = sa->len ;
+  if (!stralloc_readyplus(sa, 10)) dienomem() ;
+  stralloc_catb(sa, "/allow", 7) ;
+  tmp.s[tmpbase] = 0 ;
+  if (access(sa->s, F_OK) < 0)
+  {
+    if ((errno != ENOENT) && (errno != EACCES))
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "access ", sa->s) ;
+    }
+    sa->len = k+1 ;
+    stralloc_catb(sa, "deny", 5) ;
+    if (access(sa->s, F_OK) < 0)
+      if ((errno != ENOENT) && (errno != EACCES))
+      {
+        cleanup() ;
+        strerr_diefu2sys(111, "access ", sa->s) ;
+      }
+      else return ;
+    else if (cdb_make_add(c, sa->s + start, k - start, "D", 1) < 0)
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "cdb_make_add") ;
+    }
+  }
+  else
+  {
+    uint16 envlen = 0 ;
+    uint16 execlen = 0 ;
+    register int r ;
+    tmp.s[tmpbase] = 'A' ;
+    sa->len = k+1 ;
+    stralloc_catb(sa, "env", 4) ;
+    tmp.len = tmpbase + 3 ;
+    if ((envdir(sa->s, &tmp) < 0) && (errno != ENOENT))
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "envdir ", sa->s) ;
+    }
+    if (tmp.len > tmpbase + 4103)
+    {
+      cleanup() ;
+      strerr_diefu2sys(100, sa->s, "too big") ;
+    }
+    envlen = tmp.len - tmpbase - 3 ;
+    tmp.len = tmpbase ;
+    uint16_pack_big(tmp.s + tmpbase + 1, envlen) ;
+    sa->len = k+1 ;
+    stralloc_catb(sa, "exec", 5) ;
+    r = openreadnclose(sa->s, tmp.s + tmpbase + 5 + envlen, 4096) ;
+    if ((r < 0) && (errno != ENOENT))
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "openreadnclose ", sa->s) ;
+    }
+    if (r > 0) execlen = r ;
+    if (execlen == 4096) strerr_warnw2x("possibly truncated file ", sa->s) ;
+    uint16_pack_big(tmp.s + tmpbase + 3 + envlen, execlen) ;
+    if (cdb_make_add(c, sa->s + start, k - start, tmp.s + tmpbase, 5 + envlen + execlen) < 0)
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "cdb_make_add") ;
+    }
+  }
+}
+
+int main (int argc, char const *const *argv)
+{
+  stralloc sa = STRALLOC_ZERO ;
+  struct cdb_make c = CDB_MAKE_ZERO ;
+  DIR *dir ;
+  unsigned int start ;
+  int fd ;
+  PROG = "s6-accessrules-cdb-from-fs" ;
+  if (argc < 3) strerr_dieusage(100, USAGE) ;
+  if (!stralloc_cats(&tmp, argv[1])) return 0 ;
+  if (random_sauniquename(&tmp, 8) < 0)
+    strerr_diefu1sys(111, "random_sauniquename") ;
+  if (!stralloc_readyplus(&tmp, 8210))
+    strerr_diefu1sys(111, "stralloc_catb") ;
+  stralloc_0(&tmp) ;
+  fd = open_trunc(tmp.s) ;
+  if (fd < 0) strerr_diefu2sys(111, "open_trunc ", tmp.s) ;
+  if (cdb_make_start(&c, fd) < 0)
+  {
+    cleanup() ;
+    strerr_diefu1sys(111, "cdb_make_start") ;
+  }
+  dir = opendir(argv[2]) ;
+  if (!dir)
+  {
+    cleanup() ;
+    strerr_diefu2sys(111, "opendir ", argv[2]) ;
+  }
+  if (!stralloc_cats(&sa, argv[2]) || !stralloc_catb(&sa, "/", 1)) dienomem() ;
+  start = sa.len ;
+
+  for (;;)
+  {
+    DIR *subdir ;
+    direntry *d ;
+    unsigned int base ;
+    errno = 0 ;
+    d = readdir(dir) ;
+    if (!d) break ;
+    if (d->d_name[0] == '.') continue ;
+    sa.len = start ;
+    if (!stralloc_cats(&sa, d->d_name) || !stralloc_0(&sa)) dienomem() ;
+    base = sa.len ;
+    subdir = opendir(sa.s) ;
+    if (!subdir)
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "opendir ", sa.s) ;
+    }
+    sa.s[base-1] = '/' ;
+    for (;;)
+    {
+      errno = 0 ;
+      d = readdir(subdir) ;
+      if (!d) break ;
+      if (d->d_name[0] == '.') continue ;
+      sa.len = base ;
+      if (!stralloc_cats(&sa, d->d_name)) dienomem() ;
+      doit(&c, &sa, start) ;
+    }
+    if (errno)
+    {
+      sa.s[base-1] = 0 ;
+      cleanup() ;
+      strerr_diefu2sys(111, "readdir ", sa.s) ;
+    }
+    dir_close(subdir) ;
+  }
+  if (errno)
+  {
+    cleanup() ;
+    strerr_diefu2sys(111, "readdir ", argv[2]) ;
+  }
+  dir_close(dir) ;
+  if (cdb_make_finish(&c) < 0)
+  {
+    cleanup() ;
+    strerr_diefu1sys(111, "cdb_make_finish") ;
+  }
+  if (fd_sync(fd) < 0)
+  {
+    cleanup() ;
+    strerr_diefu1sys(111, "fd_sync") ;
+  }
+  fd_close(fd) ;
+  if (rename(tmp.s, argv[1]) < 0)
+  {
+    cleanup() ;
+    strerr_diefu4sys(111, "rename ", tmp.s, " to ", argv[1]) ;
+  }
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-accessrules-fs-from-cdb.c b/src/conn-tools/s6-accessrules-fs-from-cdb.c
new file mode 100644
index 0000000..cbe67ef
--- /dev/null
+++ b/src/conn-tools/s6-accessrules-fs-from-cdb.c
@@ -0,0 +1,177 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <unistd.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/uint16.h>
+#include <skalibs/uint32.h>
+#include <skalibs/cdb.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+
+#define USAGE "s6-accessrules-fs-from-cdb dir cdbfile"
+
+static char const *basedir ;
+unsigned int basedirlen ;
+
+static void cleanup ()
+{
+  int e = errno ;
+  rm_rf(basedir) ;
+  errno = e ;
+}
+
+static int domkdir (char const *s)
+{
+  return mkdir(s, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH | S_ISGID) < 0 ? (errno == EEXIST) : 1 ;
+}
+
+static void mkdirp (char *s)
+{
+  mode_t m = umask(0) ;
+  unsigned int len = str_len(s) ;
+  register unsigned int i = basedirlen + 1 ;
+  for (; i < len ; i++) if (s[i] == '/')
+  {
+    s[i] = 0 ;
+    if (!domkdir(s)) goto err ;
+    s[i] = '/' ;
+  }
+  if (!domkdir(s)) goto err ;
+  umask(m) ;
+  return ;
+
+ err:
+  cleanup() ;
+  strerr_diefu2sys(111, "mkdir ", s) ;
+}
+
+static void touchtrunc (char const *file)
+{
+  register int fd = open_trunc(file) ;
+  if (fd < 0) strerr_diefu2sys(111, "open_trunc ", file) ;
+  fd_close(fd) ;
+}
+
+static int doenv (char const *dir, unsigned int dirlen, char *env, unsigned int envlen)
+{
+  mode_t m = umask(0) ;
+  unsigned int i = 0 ;
+  if (!domkdir(dir))
+  {
+    cleanup() ;
+    strerr_diefu2sys(111, "mkdir ", dir) ;
+  }
+  umask(m) ;
+  while (i < envlen)
+  {
+    unsigned int n = byte_chr(env + i, envlen - i, 0) ;
+    if (i + n >= envlen) return 0 ;
+    {
+      unsigned int p = byte_chr(env + i, n, '=') ;
+      char tmp[dirlen + p + 2] ;
+      byte_copy(tmp, dirlen, dir) ;
+      tmp[dirlen] = '/' ;
+      byte_copy(tmp + dirlen + 1, p, env + i) ;
+      tmp[dirlen + p + 1] = 0 ;
+      if (p < n)
+      {
+         env[i+n] = '\n' ;
+         if (!openwritenclose_unsafe(tmp, env + i + p + 1, n - p))
+         {
+           cleanup() ;
+           strerr_diefu2sys(111, "openwritenclose_unsafe ", tmp) ;
+         }
+      }
+      else touchtrunc(tmp) ;
+    }
+    i += n + 1 ;
+  }
+  return 1 ;
+}
+
+static int doit (struct cdb *c)
+{
+  unsigned int klen = cdb_keylen(c) ;
+  unsigned int dlen = cdb_datalen(c) ;
+  {
+    uint16 envlen, execlen ;
+    char name[basedirlen + klen + 8] ;
+    char data[dlen] ;
+    byte_copy(name, basedirlen, basedir) ;
+    name[basedirlen] = '/' ;
+    if (!dlen || (dlen > 8201)) return (errno = EINVAL, 0) ;
+    if ((cdb_read(c, name+basedirlen+1, klen, cdb_keypos(c)) < 0)
+     || (cdb_read(c, data, dlen, cdb_datapos(c)) < 0))
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "cdb_read") ;
+    }
+    name[basedirlen + klen + 1] = 0 ;
+    mkdirp(name) ;
+    name[basedirlen + klen + 1] = '/' ;
+    if (data[0] == 'A')
+    {
+      byte_copy(name + basedirlen + klen + 2, 6, "allow") ;
+      touchtrunc(name) ;
+    }
+    else if (data[0] == 'D')
+    {
+      byte_copy(name + basedirlen + klen + 2, 5, "deny") ;
+      touchtrunc(name) ;
+    }
+    if (dlen < 3) return 1 ;
+    uint16_unpack_big(data + 1, &envlen) ;
+    if ((envlen > 4096U) || (3U + envlen > dlen)) return (errno = EINVAL, 0) ;
+    uint16_unpack_big(data + 3 + envlen, &execlen) ;
+    if ((execlen > 4096U) || (5U + envlen + execlen != dlen)) return (errno = EINVAL, 0) ;
+    if (envlen)
+    {
+      byte_copy(name + basedirlen + klen + 2, 4, "env") ;
+      if (!doenv(name, basedirlen + klen + 5, data + 3, envlen)) return (errno = EINVAL, 0) ;
+    }
+    byte_copy(name + basedirlen + klen + 2, 5, "exec") ;
+    if (execlen && !openwritenclose_unsafe(name, data + 5 + envlen, execlen))
+    {
+      cleanup() ;
+      strerr_diefu2sys(111, "openwritenclose_unsafe ", name) ;
+    }
+  }
+  return 1 ;
+}
+
+int main (int argc, char const *const *argv)
+{
+  struct cdb c = CDB_ZERO ;
+  uint32 kpos ;
+  PROG = "s6-accessrules-fs-from-cdb" ;
+  if (argc < 3) strerr_dieusage(100, USAGE) ;
+  if (cdb_mapfile(&c, argv[2]) < 0) strerr_diefu1sys(111, "cdb_mapfile") ;
+  basedir = argv[1] ;
+  basedirlen = str_len(argv[1]) ;
+  {
+    mode_t m = umask(0) ;
+    if (mkdir(basedir, S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH | S_ISGID) < 0)
+      strerr_diefu2sys(111, "mkdir ", basedir) ;
+    umask(m) ;
+  }
+  cdb_traverse_init(&c, &kpos) ;
+  for (;;)
+  {
+    register int r = cdb_nextkey(&c, &kpos) ;
+    if (r < 0)
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "cdb_nextkey") ;
+    }
+    else if (!r) break ;
+    else if (!doit(&c))
+    {
+      cleanup() ;
+      strerr_diefu1sys(111, "handle key") ;
+    }
+  }
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-connlimit.c b/src/conn-tools/s6-connlimit.c
new file mode 100644
index 0000000..19f4a2d
--- /dev/null
+++ b/src/conn-tools/s6-connlimit.c
@@ -0,0 +1,39 @@
+/* ISC license. */
+
+#include <skalibs/uint.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  char const *x ;
+  unsigned int protolen ;
+  PROG = "s6-connlimit" ;
+  x = env_get2(envp, "PROTO") ;
+  if (!x) strerr_dienotset(100, "PROTO") ;
+  protolen = str_len(x) ;
+  if (!protolen) strerr_dief1x(100, "empty PROTO") ;
+  {
+    unsigned int num ;
+    char s[protolen + 8] ;
+    byte_copy(s, protolen, x) ;
+    byte_copy(s + protolen, 8, "CONNNUM") ;
+    x = env_get2(envp, s) ;
+    if (!x) strerr_dienotset(100, s) ;
+    if (!uint0_scan(x, &num)) strerr_dief2x(100, "invalid ", s) ;
+    byte_copy(s + protolen + 4, 4, "MAX") ;
+    x = env_get2(envp, s) ;
+    if (x)
+    {
+      unsigned int max ;
+      if (!uint0_scan(x, &max)) strerr_dief2x(100, "invalid ", s) ;
+      if (num > max)
+        strerr_dief2x(1, "number of connections from this client limited to ", x) ;
+    }
+  }
+  pathexec0_run(argv+1, envp) ;
+  (void)argc ;
+  strerr_dieexec(111, argv[1]) ;
+}
diff --git a/src/conn-tools/s6-ioconnect.c b/src/conn-tools/s6-ioconnect.c
new file mode 100644
index 0000000..a0217bb
--- /dev/null
+++ b/src/conn-tools/s6-ioconnect.c
@@ -0,0 +1,187 @@
+/* ISC license. */
+
+#include <skalibs/nonposix.h>
+#include <sys/socket.h>
+#include <errno.h>
+#include <signal.h>
+#include <skalibs/uint.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/error.h>
+#include <skalibs/iobuffer.h>
+#include <skalibs/sig.h>
+#include <skalibs/selfpipe.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/tai.h>
+#include <skalibs/iopause.h>
+#include <skalibs/djbunix.h>
+
+#define USAGE "s6-ioconnect [ -t timeout ] [ -r fdr ] [ -w fdw ] [ -0 ] [ -1 ] [ -6 ] [ -7 ]"
+#define dieusage() strerr_dieusage(100, USAGE)
+
+
+typedef struct ioblah_s ioblah_t, *ioblah_t_ref ;
+struct ioblah_s
+{
+  unsigned int fd ;
+  unsigned int xindex ;
+  unsigned int flagsocket : 1 ;
+  unsigned int flagopen : 1 ;
+} ;
+
+static ioblah_t a[2][2] = { { { 0, 4, 0, 1 }, { 7, 4, 0, 1 } }, { { 6, 4, 0, 1 }, { 1, 4, 0, 1 } } } ;
+static iobuffer b[2] ;
+static iopause_fd x[5] = { { -1, IOPAUSE_READ, 0 } } ;
+
+static void closeit (unsigned int i, unsigned int j)
+{
+  if (a[i][j].flagsocket)
+  {
+    if ((shutdown(a[i][j].fd, j) < 0) && (errno != ENOTSOCK) && (errno != ENOTCONN))
+      strerr_warnwu4sys("shutdown ", i ? "incoming" : "outgoing", " socket for ", j ? "writing" : "reading") ;
+  }
+  fd_close(a[i][j].fd) ;
+  a[i][j].flagopen = 0 ;
+  a[i][j].xindex = 5 ;
+}
+
+static inline void finishit (unsigned int i)
+{
+  closeit(i, 1) ;
+  iobuffer_finish(&b[i]) ;
+}
+
+static void handle_signals (void)
+{
+  for (;;)
+  {
+    char c = selfpipe_read() ;
+    switch (c)
+    {
+      case -1 : strerr_diefu1sys(111, "selfpipe_read") ;
+      case 0 : return ;
+      case SIGTERM :
+      {
+        if (a[0][0].xindex < 5) x[a[0][0].xindex].revents |= IOPAUSE_EXCEPT ;
+        if (a[1][0].xindex < 5) x[a[1][0].xindex].revents |= IOPAUSE_EXCEPT ;
+        break ;
+      }
+      default :
+        strerr_dief1x(101, "internal error: inconsistent signal state. Please submit a bug-report.") ;
+    }
+  }
+}
+
+int main (int argc, char const *const *argv)
+{
+  tain_t tto ;
+  register unsigned int i, j ;
+  PROG = "s6-ioconnect" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    unsigned int t = 0 ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "0167t:r:w:", &l) ;
+      if (opt < 0) break ;
+      switch (opt)
+      {
+        case '0' : a[0][0].flagsocket = 1 ; break ;
+        case '1' : a[1][1].flagsocket = 1 ; break ;
+        case '6' : a[1][0].flagsocket = 1 ; break ;
+        case '7' : a[0][1].flagsocket = 1 ; break ;
+        case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+        case 'r' : if (!uint0_scan(l.arg, &a[1][0].fd)) dieusage() ; break ;
+        case 'w' : if (!uint0_scan(l.arg, &a[0][1].fd)) dieusage() ; break ;
+        default : dieusage() ;
+      }
+    }
+    if (t) tain_from_millisecs(&tto, t) ; else tto = tain_infinite_relative ;
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if ((a[0][1].fd < 3) || (a[1][0].fd < 3)) dieusage() ;
+  for (i = 0 ; i < 2 ; i++)
+  {
+    for (j = 0 ; j < 2 ; j++)
+      if (ndelay_on(a[i][j].fd) == -1) strerr_diefu1sys(111, "ndelay_on") ;
+    if (!iobuffer_init(&b[i], a[i][0].fd, a[i][1].fd) < 0) strerr_diefu1sys(111, "iobuffer_init") ;
+  }
+  if (sig_ignore(SIGPIPE) == -1) strerr_diefu1sys(111, "sig_ignore") ;
+  tain_now_g() ;
+  x[0].fd = selfpipe_init() ;
+  if (x[0].fd < 0) strerr_diefu1sys(111, "selfpipe_init") ;
+  if (selfpipe_trap(SIGTERM) < 0)
+    strerr_diefu1sys(111, "trap SIGTERM") ;
+
+  for (;;)
+  {
+    tain_t deadline ;
+    unsigned int xlen = 1 ;
+    int r ;
+
+    tain_add_g(&deadline, iobuffer_isempty(&b[0]) && iobuffer_isempty(&b[1]) ? &tto : &tain_infinite_relative) ;
+    for (i = 0 ; i < 2 ; i++)
+    {
+      a[i][0].xindex = 5 ;
+      if (a[i][0].flagopen && iobuffer_isreadable(&b[i]))
+      {
+        x[xlen].fd = a[i][0].fd ;
+        x[xlen].events = IOPAUSE_READ ;
+        a[i][0].xindex = xlen++ ;
+      }
+      a[i][1].xindex = 5 ;
+      if (a[i][1].flagopen)
+      {
+        x[xlen].fd = a[i][1].fd ;
+        x[xlen].events = IOPAUSE_EXCEPT | (iobuffer_isempty(&b[i]) ? 0 : IOPAUSE_WRITE) ;
+        a[i][1].xindex = xlen++ ;
+      }
+    }
+    if (xlen <= 1) break ;
+
+    r = iopause_g(x, xlen, &deadline) ;
+    if (r < 0) strerr_diefu1sys(111, "iopause") ;
+    else if (!r) return 1 ;
+
+    if (x[0].revents & IOPAUSE_READ) handle_signals() ;
+
+    for (i = 0 ; i < 2 ; i++) if (a[i][1].xindex < 5)
+    {
+      if (x[a[i][1].xindex].revents & IOPAUSE_WRITE)
+      {
+        if (!iobuffer_flush(&b[i]))
+        {
+          if (!error_isagain(errno)) x[a[i][1].xindex].revents |= IOPAUSE_EXCEPT ;
+        }
+        else if (!a[i][0].flagopen) finishit(i) ;
+      }
+      if (x[a[i][1].xindex].revents & IOPAUSE_EXCEPT)
+      {
+        if (!iobuffer_isempty(&b[i]))
+        {
+          iobuffer_flush(&b[i]) ; /* sets errno */
+          strerr_warnwu3sys("write ", i ? "incoming" : "outgoing", " data") ;
+        }
+        closeit(i, 0) ; finishit(i) ;
+      }
+    }
+
+    for (i = 0 ; i < 2 ; i++) if (a[i][0].xindex < 5)
+    {
+      if (x[a[i][0].xindex].revents & IOPAUSE_READ)
+      {
+        if (sanitize_read(iobuffer_fill(&b[i])) < 0)
+        {
+          if (errno != EPIPE) strerr_warnwu3sys("read ", i ? "incoming" : "outgoing", " data") ;
+          x[a[i][0].xindex].revents |= IOPAUSE_EXCEPT ;
+        }
+      }
+      if (x[a[i][0].xindex].revents & IOPAUSE_EXCEPT)
+      {
+        closeit(i, 0) ;
+        if (iobuffer_isempty(&b[i])) finishit(i) ;
+      }
+    }
+  }
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-ipcclient.c b/src/conn-tools/s6-ipcclient.c
new file mode 100644
index 0000000..61864bc
--- /dev/null
+++ b/src/conn-tools/s6-ipcclient.c
@@ -0,0 +1,66 @@
+/* ISC license. */
+
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/webipc.h>
+
+#define USAGE "s6-ipcclient [ -q | -Q | -v ] [ -p bindpath ] [ -l localname ] path prog..."
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  char const *bindpath = 0 ;
+  char const *localname = 0 ;
+  unsigned int verbosity = 1 ;
+  PROG = "s6-ipcclient" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "qQvp:l:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'q' : if (verbosity) verbosity-- ; break ;
+        case 'Q' : verbosity = 1 ; break ;
+        case 'v' : verbosity++ ; break ;
+        case 'p' : bindpath = l.arg ; break ;
+        case 'l' : localname = l.arg ; break ;
+        default : strerr_dieusage(100, USAGE) ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (argc < 2) strerr_dieusage(100, USAGE) ;
+  {
+    char modif[24 + IPCPATH_MAX] = "PROTO=IPC\0IPCLOCALPATH=" ;
+    unsigned int i = 23 ;
+    int s = ipc_stream() ;
+    if (s < 0) strerr_diefu1sys(111, "create socket") ;
+    if (bindpath && (ipc_bind(s, bindpath) == -1))
+      strerr_diefu2sys(111, "bind socket to ", bindpath) ;
+    if (!ipc_connect(s, argv[0]))
+      strerr_diefu2sys(111, "connect to ", argv[0]) ;
+    if (verbosity >= 2) strerr_warn3x(PROG, ": connected to ", argv[0]) ;
+    if (localname)
+    {
+      register unsigned int n = str_len(localname) ;
+      if (n > IPCPATH_MAX) n = IPCPATH_MAX ;
+      byte_copy(modif + i, n, localname) ;
+      i += n ; modif[i++] = 0 ;
+    }
+    else
+    {
+      int dummy ;
+      if (ipc_local(s, modif + i, IPCPATH_MAX, &dummy) < 0) modif[--i] = 0 ;
+      else i += str_len(modif + i) + 1 ;
+    }
+    if (fd_move(6, s) < 0)
+      strerr_diefu2sys(111, "set up fd ", "6") ;
+    if (fd_copy(7, 6) < 0)
+      strerr_diefu2sys(111, "set up fd ", "7") ;
+    pathexec_r(argv+1, envp, env_len(envp), modif, i) ;
+  }
+  strerr_dieexec(111, argv[1]) ;
+}
diff --git a/src/conn-tools/s6-ipcserver-access.c b/src/conn-tools/s6-ipcserver-access.c
new file mode 100644
index 0000000..629fabb
--- /dev/null
+++ b/src/conn-tools/s6-ipcserver-access.c
@@ -0,0 +1,211 @@
+/* ISC license. */
+
+#include <unistd.h>
+#include <errno.h>
+#include <skalibs/gccattributes.h>
+#include <skalibs/uint.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/cdb.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/webipc.h>
+#include <execline/config.h>
+#include <s6/accessrules.h>
+
+#define USAGE "s6-ipcserver-access [ -v verbosity ] [ -e | -E ] [ -l localname ] [ -i rulesdir | -x rulesfile ] prog..."
+
+static unsigned int verbosity = 1 ;
+
+ /* Utility functions */
+
+static inline void dieusage (void) gccattr_noreturn ;
+static inline void dieusage ()
+{
+  strerr_dieusage(100, USAGE) ;
+}
+
+static inline void dienomem (void) gccattr_noreturn ;
+static inline void dienomem ()
+{
+  strerr_diefu1sys(111, "update environment") ;
+}
+
+static inline void X (void) gccattr_noreturn ;
+static inline void X ()
+{
+  strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") ;
+}
+
+
+ /* Logging */
+
+static void logit (unsigned int pid, unsigned int uid, unsigned int gid, int h)
+{
+  char fmtpid[UINT_FMT] ;
+  char fmtuid[UINT_FMT] ;
+  char fmtgid[UINT_FMT] ;
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  fmtuid[uint_fmt(fmtuid, uid)] = 0 ;
+  fmtgid[uint_fmt(fmtgid, gid)] = 0 ;
+  if (h) strerr_warni7x("allow", " pid ", fmtpid, " uid ", fmtuid, " gid ", fmtgid) ;
+  else strerr_warni7sys("deny", " pid ", fmtpid, " uid ", fmtuid, " gid ", fmtgid) ;
+}
+
+static inline void log_accept (unsigned int pid, unsigned int uid, unsigned int gid)
+{
+  logit(pid, uid, gid, 1) ;
+}
+
+static inline void log_deny (unsigned int pid, unsigned int uid, unsigned int gid)
+{
+  logit(pid, uid, gid, 0) ;
+}
+
+
+ /* Checking */
+
+static s6_accessrules_result_t check_cdb (unsigned int uid, unsigned int gid, char const *file, s6_accessrules_params_t *params)
+{
+  struct cdb c = CDB_ZERO ;
+  int fd = open_readb(file) ;
+  register s6_accessrules_result_t r ;
+  if (fd < 0) return -1 ;
+  if (cdb_init(&c, fd) < 0) strerr_diefu2sys(111, "cdb_init ", file) ;
+  r = s6_accessrules_uidgid_cdb(uid, gid, &c, params) ;
+  cdb_free(&c) ;
+  fd_close(fd) ;
+  return r ;
+}
+
+static inline int check (s6_accessrules_params_t *params, char const *rules, unsigned int rulestype, unsigned int uid, unsigned int gid)
+{
+  char const *x = "" ;
+  s6_accessrules_result_t r ;
+  switch (rulestype)
+  {
+    case 0 :
+      if (verbosity >= 2) strerr_warnw1x("invoked without a ruleset!") ;
+      return 1 ;
+    case 1 :
+      r = s6_accessrules_uidgid_fs(uid, gid, rules, params) ;
+      x = "fs" ;
+      break ;
+    case 2 :
+      r = check_cdb(uid, gid, rules, params) ;
+      x = "cdb" ;
+      break ;
+    default : X() ;
+  }
+  switch (r)
+  {
+    case S6_ACCESSRULES_ERROR : strerr_diefu4sys(111, "check ", x, " ruleset in ", rules) ;
+    case S6_ACCESSRULES_ALLOW :    return 1 ;
+    case S6_ACCESSRULES_DENY :     return (errno = EACCES, 0) ;
+    case S6_ACCESSRULES_NOTFOUND : return (errno = ENOENT, 0) ;
+    default : X() ;
+  }
+}
+
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  s6_accessrules_params_t params = S6_ACCESSRULES_PARAMS_ZERO ;
+  char const *rules = 0 ;
+  char const *localname = 0 ;
+  char const *proto ;
+  unsigned int protolen ;
+  unsigned int uid = 0, gid = 0 ;
+  unsigned int rulestype = 0 ;
+  int doenv = 1 ;
+  PROG = "s6-ipcserver-access" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "v:Eel:i:x:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
+        case 'E' : doenv = 0 ; break ;
+        case 'e' : doenv = 1 ; break ;
+        case 'l' : localname = l.arg ; break ;
+        case 'i' : rules = l.arg ; rulestype = 1 ; break ;
+        case 'x' : rules = l.arg ; rulestype = 2 ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (!argc) dieusage() ;
+  if (!*argv[0]) dieusage() ;
+
+  proto = env_get2(envp, "PROTO") ;
+  if (!proto) strerr_dienotset(100, "PROTO") ;
+  protolen = str_len(proto) ;
+
+  {
+    char const *x ;
+    char tmp[protolen + 11] ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 11, "REMOTEEUID") ;
+    x = env_get2(envp, tmp) ;
+    if (!x) strerr_dienotset(100, tmp) ;
+    if (!uint0_scan(x, &uid)) strerr_dieinvalid(100, tmp) ;
+    tmp[protolen + 7] = 'G' ;
+    x = env_get2(envp, tmp) ;
+    if (!x) strerr_dienotset(100, tmp) ;
+    if (!uint0_scan(x, &gid)) strerr_dieinvalid(100, tmp) ;
+  }
+
+  if (!check(&params, rules, rulestype, uid, gid))
+  {
+    if (verbosity >= 2) log_deny(getpid(), uid, gid) ;
+    return 1 ;
+  }
+  if (verbosity) log_accept(getpid(), uid, gid) ;
+
+  if (doenv)
+  {
+    char tmp[protolen + 10] ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 10, "LOCALPATH") ;
+    if (localname)
+    {
+      if (!env_addmodif(&params.env, tmp, localname)) dienomem() ;
+    }
+    else
+    {
+      char curname[IPCPATH_MAX+1] ;
+      int dummy ;
+      if (ipc_local(0, curname, IPCPATH_MAX+1, &dummy) < 0)
+        strerr_diefu1sys(111, "ipc_local") ;
+      if (!env_addmodif(&params.env, tmp, curname)) dienomem() ;
+    }
+  }
+  else
+  {
+    char tmp[protolen + 11] ;
+    byte_copy(tmp, protolen, proto) ;
+    byte_copy(tmp + protolen, 11, "REMOTEEUID") ;
+    if (!env_addmodif(&params.env, "PROTO", 0)) dienomem() ;
+    if (!env_addmodif(&params.env, tmp, 0)) dienomem() ;
+    tmp[protolen + 7] = 'G' ;
+    if (!env_addmodif(&params.env, tmp, 0)) dienomem() ;
+    byte_copy(tmp + protolen + 6, 5, "PATH") ;
+    if (!env_addmodif(&params.env, tmp, 0)) dienomem() ;
+    byte_copy(tmp + protolen, 10, "LOCALPATH") ;
+    if (!env_addmodif(&params.env, tmp, 0)) dienomem() ;
+  }
+
+  if (params.exec.len)
+  {
+    char *specialargv[4] = { EXECLINE_EXTBINPREFIX "execlineb", "-c", params.exec.s, 0 } ;
+    pathexec_r((char const *const *)specialargv, envp, env_len(envp), params.env.s, params.env.len) ;
+    strerr_dieexec(111, specialargv[0]) ;
+  }
+
+  pathexec_r(argv, envp, env_len(envp), params.env.s, params.env.len) ;
+  strerr_dieexec(111, argv[0]) ;
+}
diff --git a/src/conn-tools/s6-ipcserver-socketbinder.c b/src/conn-tools/s6-ipcserver-socketbinder.c
new file mode 100644
index 0000000..b5a32f3
--- /dev/null
+++ b/src/conn-tools/s6-ipcserver-socketbinder.c
@@ -0,0 +1,49 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <skalibs/uint.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/webipc.h>
+
+#define USAGE "s6-ipcserver-socketbinder [ -d | -D ] [ -b backlog ] path prog..."
+#define dieusage() strerr_dieusage(100, USAGE)
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  unsigned int backlog = 20 ;
+  int flagreuse = 1 ;
+  PROG = "s6-ipcserver-socketbinder" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "Ddb:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'D' : flagreuse = 0 ; break ;
+        case 'd' : flagreuse = 1 ; break ;
+        case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (argc < 2) dieusage() ;
+  close(0) ;
+  if (ipc_stream()) strerr_diefu1sys(111, "create socket") ;
+  {
+    mode_t m = umask(0) ;
+    if ((flagreuse ? ipc_bind_reuse(0, argv[0]) : ipc_bind(0, argv[0])) < 0)
+      strerr_diefu2sys(111, "bind to ", argv[0]) ;
+    umask(m) ;
+  }
+  if (ipc_listen(0, backlog) < 0) strerr_diefu2sys(111, "listen to ", argv[0]) ;
+
+  pathexec_run(argv[1], argv + 1, envp) ;
+  strerr_dieexec(111, argv[1]) ;
+}
diff --git a/src/conn-tools/s6-ipcserver.c b/src/conn-tools/s6-ipcserver.c
new file mode 100644
index 0000000..ccc76f6
--- /dev/null
+++ b/src/conn-tools/s6-ipcserver.c
@@ -0,0 +1,127 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <limits.h>
+#include <skalibs/uint.h>
+#include <skalibs/gidstuff.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <s6/config.h>
+
+#define USAGE "s6-ipcserver [ -q | -Q | -v ] [ -d | -D ] [ -P | -p ] [ -1 ] [ -c maxconn ] [ -C localmaxconn ] [ -b backlog ] [ -G gid,gid,... ] [ -g gid ] [ -u uid ] [ -U ] path prog..."
+#define dieusage() strerr_dieusage(100, USAGE)
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  unsigned int verbosity = 1 ;
+  int flag1 = 0 ;
+  int flagU = 0 ;
+  int flaglookup = 1 ;
+  int flagreuse = 1 ;
+  unsigned int uid = 0, gid = 0 ;
+  gid_t gids[NGROUPS_MAX] ;
+  unsigned int gidn = (unsigned int)-1 ;
+  unsigned int maxconn = 0 ;
+  unsigned int localmaxconn = 0 ;
+  unsigned int backlog = (unsigned int)-1 ;
+  PROG = "s6-ipcserver" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "qQvDd1UPpc:C:b:u:g:G:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'q' : verbosity = 0 ; break ;
+        case 'Q' : verbosity = 1 ; break ;
+        case 'v' : verbosity = 2 ; break ;
+        case 'D' : flagreuse = 0 ; break ;
+        case 'd' : flagreuse = 1 ; break ;
+        case 'P' : flaglookup = 0 ; break ;
+        case 'p' : flaglookup = 1 ; break ;
+        case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; if (!maxconn) maxconn = 1 ; break ;
+        case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; if (!localmaxconn) localmaxconn = 1 ; break ;
+        case 'b' : if (!uint0_scan(l.arg, &backlog)) dieusage() ; break ;
+        case 'u' : if (!uint0_scan(l.arg, &uid)) dieusage() ; break ;
+        case 'g' : if (!uint0_scan(l.arg, &gid)) dieusage() ; break ;
+        case 'G' : if (!gid_scanlist(gids, NGROUPS_MAX, l.arg, &gidn) && *l.arg) dieusage() ; break ;
+        case '1' : flag1 = 1 ; break ;
+        case 'U' : flagU = 1 ; uid = 0 ; gid = 0 ; gidn = (unsigned int)-1 ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+    if (argc < 2) dieusage() ;
+  }
+
+  {
+    unsigned int m = 0 ;
+    unsigned int pos = 0 ;
+    char fmt[UINT_FMT * 5 + GID_FMT * NGROUPS_MAX] ;
+    char const *newargv[24 + argc] ;
+    newargv[m++] = S6_BINPREFIX "s6-ipcserver-socketbinder" ;
+    if (!flagreuse) newargv[m++] = "-D" ;
+    if (backlog != (unsigned int)-1)
+    {
+      newargv[m++] = "-b" ;
+      newargv[m++] = fmt + pos ;
+      pos += uint_fmt(fmt + pos, backlog) ;
+      fmt[pos++] = 0 ;
+    }
+    newargv[m++] = "--" ;
+    newargv[m++] = *argv++ ;
+    if (flagU || uid || gid || gidn != (unsigned int)-1)
+    {
+      newargv[m++] = S6_BINPREFIX "s6-applyuidgid" ;
+      if (flagU) newargv[m++] = "-Uz" ;
+      if (uid)
+      {
+        newargv[m++] = "-u" ;
+        newargv[m++] = fmt + pos ;
+        pos += uint_fmt(fmt + pos, uid) ;
+        fmt[pos++] = 0 ;
+      }
+      if (gid)
+      {
+        newargv[m++] = "-g" ;
+        newargv[m++] = fmt + pos ;
+        pos += uint_fmt(fmt + pos, gid) ;
+        fmt[pos++] = 0 ;
+      }
+      if (gidn != (unsigned int)-1)
+      {
+        newargv[m++] = "-G" ;
+        newargv[m++] = fmt + pos ;
+        pos += gid_fmtlist(fmt + pos, gids, gidn) ;
+        fmt[pos++] = 0 ;
+      }
+      newargv[m++] = "--" ;
+    }
+    newargv[m++] = S6_BINPREFIX "s6-ipcserverd" ;
+    if (!verbosity) newargv[m++] = "-v0" ;
+    else if (verbosity == 2) newargv[m++] = "-v2" ;
+    if (flag1) newargv[m++] = "-1" ;
+    if (!flaglookup) newargv[m++] = "-P" ;
+    if (maxconn)
+    {
+      newargv[m++] = "-c" ;
+      newargv[m++] = fmt + pos ;
+      pos += uint_fmt(fmt + pos, maxconn) ;
+      fmt[pos++] = 0 ;
+    }
+    if (localmaxconn)
+    {
+      newargv[m++] = "-C" ;
+      newargv[m++] = fmt + pos ;
+      pos += uint_fmt(fmt + pos, localmaxconn) ;
+      fmt[pos++] = 0 ;
+    }
+    newargv[m++] = "--" ;
+    while (*argv) newargv[m++] = *argv++ ;
+    newargv[m++] = 0 ;
+    pathexec_run(newargv[0], newargv, envp) ;
+    strerr_dieexec(111, newargv[0]) ;
+  }
+}
diff --git a/src/conn-tools/s6-ipcserverd.c b/src/conn-tools/s6-ipcserverd.c
new file mode 100644
index 0000000..4afe5cc
--- /dev/null
+++ b/src/conn-tools/s6-ipcserverd.c
@@ -0,0 +1,399 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <skalibs/uint.h>
+#include <skalibs/gccattributes.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/diuint.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/sig.h>
+#include <skalibs/selfpipe.h>
+#include <skalibs/iopause.h>
+#include <skalibs/webipc.h>
+
+#define USAGE "s6-ipcserverd [ -v verbosity ] [ -1 ] [ -P | -p ] [ -c maxconn ] [ -C localmaxconn ] prog..."
+
+#define ABSOLUTE_MAXCONN 1000
+
+static unsigned int maxconn = 40 ;
+static unsigned int localmaxconn = 40 ;
+static char fmtmaxconn[UINT_FMT+1] = "/" ;
+static char fmtlocalmaxconn[UINT_FMT+1] = "/" ;
+static int flaglookup = 1 ;
+static unsigned int verbosity = 1 ;
+static int cont = 1 ;
+
+static diuint *piduid ;
+static unsigned int numconn = 0 ;
+static diuint *uidnum ;
+static unsigned int uidlen = 0 ;
+
+
+ /* Utility functions */
+
+static inline void dieusage ()
+{
+  strerr_dieusage(100, USAGE) ;
+}
+
+static inline void X (void)
+{
+  strerr_dief1x(101, "internal inconsistency. Please submit a bug-report.") ;
+}
+
+
+ /* Lookup primitives */
+
+static unsigned int lookup_diuint (diuint const *tab, unsigned int tablen, unsigned int key)
+{
+  register unsigned int i = 0 ;
+  for (; i < tablen ; i++) if (key == tab[i].left) break ;
+  return i ;
+}
+
+static inline unsigned int lookup_pid (unsigned int pid)
+{
+  return lookup_diuint(piduid, numconn, pid) ;
+}
+
+static inline unsigned int lookup_uid (unsigned int uid)
+{
+  return lookup_diuint(uidnum, uidlen, uid) ;
+}
+
+
+ /* Logging */
+
+static inline void log_start (void)
+{
+  strerr_warni1x("starting") ;
+}
+
+static inline void log_exit (void)
+{
+  strerr_warni1x("exiting") ;
+}
+
+static void log_status (void)
+{
+  char fmt[UINT_FMT] ;
+  fmt[uint_fmt(fmt, numconn)] = 0 ;
+  strerr_warni3x("status: ", fmt, fmtmaxconn) ;
+}
+
+static void log_deny (unsigned int uid, unsigned int gid, unsigned int num)
+{
+  char fmtuid[UINT_FMT] = "?" ;
+  char fmtgid[UINT_FMT] = "?" ;
+  char fmtnum[UINT_FMT] = "?" ;
+  if (flaglookup)
+  {
+    fmtuid[uint_fmt(fmtuid, uid)] = 0 ;
+    fmtgid[uint_fmt(fmtgid, gid)] = 0 ;
+    fmtnum[uint_fmt(fmtnum, num)] = 0 ;
+  }
+  strerr_warni7sys("deny ", fmtuid, ":", fmtgid, " count ", fmtnum, fmtlocalmaxconn) ;
+}
+
+static void log_accept (unsigned int pid, unsigned int uid, unsigned int gid, unsigned int num)
+{
+  char fmtuidgid[UINT_FMT * 2 + 1] = "?:?" ;
+  char fmtpid[UINT_FMT] ;
+  char fmtnum[UINT_FMT] = "?" ;
+  if (flaglookup)
+  {
+    register unsigned int n = uint_fmt(fmtuidgid, uid) ;
+    fmtuidgid[n++] = ':' ;
+    n += uint_fmt(fmtuidgid + n, gid) ;
+    fmtuidgid[n] = 0 ;
+    fmtnum[uint_fmt(fmtnum, num)] = 0 ;
+  }
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  strerr_warni7x("allow ", fmtuidgid, " pid ", fmtpid, " count ", fmtnum, fmtlocalmaxconn) ;
+}
+
+static void log_close (unsigned int pid, unsigned int uid, int w)
+{
+  char fmtpid[UINT_FMT] ;
+  char fmtuid[UINT_FMT] = "?" ;
+  char fmtw[UINT_FMT] ;
+  fmtpid[uint_fmt(fmtpid, pid)] = 0 ;
+  if (flaglookup) fmtuid[uint_fmt(fmtuid, uid)] = 0 ;
+  fmtw[uint_fmt(fmtw, WIFSIGNALED(w) ? WTERMSIG(w) : WEXITSTATUS(w))] = 0 ;
+  strerr_warni6x("end pid ", fmtpid, " uid ", fmtuid, WIFSIGNALED(w) ? " signal " : " exitcode ", fmtw) ;
+}
+
+
+ /* Signal handling */
+
+static void killthem (int sig)
+{
+  register unsigned int i = 0 ;
+  for (; i < numconn ; i++) kill(piduid[i].left, sig) ;
+}
+
+static void wait_children (void)
+{
+  for (;;)
+  {
+    unsigned int i ;
+    int w ;
+    register pid_t pid = wait_nohang(&w) ;
+    if (pid < 0)
+      if (errno != ECHILD) strerr_diefu1sys(111, "wait_nohang") ;
+      else break ;
+    else if (!pid) break ;
+    i = lookup_pid(pid) ;
+    if (i < numconn)
+    {
+      unsigned int uid = piduid[i].right ;
+      register unsigned int j = lookup_uid(uid) ;
+      if (j >= uidlen) X() ;
+      if (!--uidnum[j].right) uidnum[j] = uidnum[--uidlen] ;
+      piduid[i] = piduid[--numconn] ;
+      if (verbosity >= 2)
+      {
+        log_close(pid, uid, w) ;
+        log_status() ;
+      }
+    }
+  }
+}
+
+static void handle_signals (void)
+{
+  for (;;) switch (selfpipe_read())
+  {
+    case -1 : strerr_diefu1sys(111, "read selfpipe") ;
+    case 0 : return ;
+    case SIGCHLD : wait_children() ; break ;
+    case SIGTERM :
+    {
+      if (verbosity >= 2)
+        strerr_warni3x("received ", "SIGTERM,", " quitting") ;
+      cont = 0 ;
+      break ;
+    }
+    case SIGHUP :
+    {
+      if (verbosity >= 2)
+        strerr_warni5x("received ", "SIGHUP,", " sending ", "SIGTERM+SIGCONT", " to all connections") ;
+      killthem(SIGTERM) ;
+      killthem(SIGCONT) ;
+      break ;
+    }
+    case SIGQUIT :
+    {
+      if (verbosity >= 2)
+        strerr_warni6x("received ", "SIGQUIT,", " sending ", "SIGTERM+SIGCONT", " to all connections", " and quitting") ;
+      cont = 0 ;
+      killthem(SIGTERM) ;
+      killthem(SIGCONT) ;
+      break ;
+    }
+    case SIGABRT :
+    {
+      if (verbosity >= 2)
+        strerr_warni6x("received ", "SIGABRT,", " sending ", "SIGKILL", " to all connections", " and quitting") ;
+      cont = 0 ;
+      killthem(SIGKILL) ;
+      break ;
+    }
+    default : X() ;
+  }
+}
+
+
+ /* New connection handling */
+
+static void run_child (int, unsigned int, unsigned int, unsigned int, char const *, char const *const *, char const *const *) gccattr_noreturn ;
+static void run_child (int s, unsigned int uid, unsigned int gid, unsigned int num, char const *remotepath, char const *const *argv, char const *const *envp)
+{
+  unsigned int rplen = str_len(remotepath) + 1 ;
+  unsigned int n = 0 ;
+  char fmt[65 + UINT_FMT * 3 + rplen] ;
+  PROG = "s6-ipcserver (child)" ;
+  if ((fd_move(0, s) < 0) || (fd_copy(1, 0) < 0))
+    strerr_diefu1sys(111, "move fds") ;
+  byte_copy(fmt+n, 23, "PROTO=IPC\0IPCREMOTEEUID") ; n += 23 ;
+  if (flaglookup)
+  {
+    fmt[n++] = '=' ;
+    n += uint_fmt(fmt+n, uid) ;
+  }
+  fmt[n++] = 0 ;
+  byte_copy(fmt+n, 13, "IPCREMOTEEGID") ; n += 13 ;
+  if (flaglookup)
+  {
+    fmt[n++] = '=' ;
+    n += uint_fmt(fmt+n, gid) ;
+  }
+  fmt[n++] = 0 ;
+  byte_copy(fmt+n, 11, "IPCCONNNUM=") ; n += 11 ;
+  if (flaglookup) n += uint_fmt(fmt+n, num) ;
+  fmt[n++] = 0 ;
+  byte_copy(fmt+n, 14, "IPCREMOTEPATH=") ; n += 14 ;
+  byte_copy(fmt+n, rplen, remotepath) ; n += rplen ;
+  pathexec_r(argv, envp, env_len(envp), fmt, n) ;
+  strerr_dieexec(111, argv[0]) ;
+}
+
+static void new_connection (int s, char const *remotepath, char const *const *argv, char const *const *envp)
+{
+  unsigned int uid = 0, gid = 0 ;
+  unsigned int num, i ;
+  register pid_t pid ;
+  if (flaglookup && (ipc_eid(s, &uid, &gid) < 0))
+  {
+    if (verbosity) strerr_warnwu1sys("ipc_eid") ;
+    return ;
+  }
+  i = lookup_uid(uid) ;
+  num = (i < uidlen) ? uidnum[i].right : 0 ;
+  if (num >= localmaxconn)
+  {
+    log_deny(uid, gid, num) ;
+    return ;
+  }
+  pid = fork() ;
+  if (pid < 0)
+  {
+    if (verbosity) strerr_warnwu1sys("fork") ;
+    return ;
+  }
+  else if (!pid)
+  {
+    selfpipe_finish() ;
+    run_child(s, uid, gid, num+1, remotepath, argv, envp) ;
+  }
+
+  if (i < uidlen) uidnum[i].right = num + 1 ;
+  else
+  {
+    uidnum[uidlen].left = uid ;
+    uidnum[uidlen++].right = 1 ;
+  }
+  piduid[numconn].left = (unsigned int)pid ;
+  piduid[numconn++].right = uid ;
+  if (verbosity >= 2)
+  {
+    log_accept((unsigned int)pid, uid, gid, uidnum[i].right) ;
+    log_status() ;
+  }
+}
+
+
+ /* And the main */
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  iopause_fd x[2] = { { .events = IOPAUSE_READ }, { .fd = 0, .events = IOPAUSE_READ | IOPAUSE_EXCEPT } } ;
+  PROG = "s6-ipcserverd" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    int flag1 = 0 ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "Pp1c:C:v:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'P' : flaglookup = 0 ; break ;
+        case 'p' : flaglookup = 1 ; break ;
+        case '1' : flag1 = 1 ; break ;
+        case 'c' : if (!uint0_scan(l.arg, &maxconn)) dieusage() ; break ;
+        case 'C' : if (!uint0_scan(l.arg, &localmaxconn)) dieusage() ; break ;
+        case 'v' : if (!uint0_scan(l.arg, &verbosity)) dieusage() ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+    if (!argc || !*argv[0]) dieusage() ;
+    {
+      struct stat st ;
+      if (fstat(0, &st) < 0) strerr_diefu1sys(111, "fstat stdin") ;
+      if (!S_ISSOCK(st.st_mode)) strerr_dief1x(100, "stdin is not a socket") ;
+    }
+    if (coe(0) < 0) strerr_diefu1sys(111, "make socket close-on-exec") ;
+    if (flag1)
+    {
+      if (fcntl(1, F_GETFD) < 0)
+        strerr_dief1sys(100, "called with option -1 but stdout said") ;
+    }
+    else close(1) ;
+    if (!maxconn) maxconn = 1 ;
+    if (maxconn > ABSOLUTE_MAXCONN) maxconn = ABSOLUTE_MAXCONN ;
+    if (!flaglookup || (localmaxconn > maxconn)) localmaxconn = maxconn ;
+
+    x[0].fd = selfpipe_init() ;
+    if (x[0].fd == -1) strerr_diefu1sys(111, "create selfpipe") ;
+    if (sig_ignore(SIGPIPE) < 0) strerr_diefu1sys(111, "ignore SIGPIPE") ;
+    {
+      sigset_t set ;
+      sigemptyset(&set) ;
+      sigaddset(&set, SIGCHLD) ;
+      sigaddset(&set, SIGTERM) ;
+      sigaddset(&set, SIGHUP) ;
+      sigaddset(&set, SIGQUIT) ;
+      sigaddset(&set, SIGABRT) ;
+      if (selfpipe_trapset(&set) < 0) strerr_diefu1sys(111, "trap signals") ;
+    }
+
+    fmtlocalmaxconn[1+uint_fmt(fmtlocalmaxconn+1, localmaxconn)] = 0 ;
+    if (verbosity >= 2)
+    {
+      fmtmaxconn[1+uint_fmt(fmtmaxconn+1, maxconn)] = 0 ;
+      log_start() ;
+      log_status() ;
+    }
+    if (flag1)
+    {
+      fd_write(1, "\n", 1) ;
+      fd_close(1) ;
+    }
+  }
+
+  {
+    diuint inyostack[maxconn + (flaglookup ? maxconn : 1)] ;
+    piduid = inyostack ; uidnum = inyostack + maxconn ;
+
+    while (cont)
+    {
+      if (iopause_g(x, 1 + (numconn < maxconn), 0) < 0)
+        strerr_diefu1sys(111, "iopause") ;
+
+      if (x[0].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with selfpipe") ;
+      if (x[0].revents & IOPAUSE_READ) handle_signals() ;
+      if (numconn < maxconn)
+      {
+        if (x[1].revents & IOPAUSE_EXCEPT) strerr_dief1x(111, "trouble with socket") ;
+        if (x[1].revents & IOPAUSE_READ)
+        {
+          int dummy ;
+          char remotepath[IPCPATH_MAX+1] ;
+          register int s = ipc_accept(x[1].fd, remotepath, IPCPATH_MAX+1, &dummy) ;
+          if (s < 0)
+          {
+            if (verbosity) strerr_warnwu1sys("accept") ;
+          }
+          else
+          {
+            new_connection(s, remotepath, argv, envp) ;
+            fd_close(s) ;
+          }
+        }
+      }
+    }
+  }
+  if (verbosity >= 2) log_exit() ;
+  return 0 ;
+}
diff --git a/src/conn-tools/s6-sudo.c b/src/conn-tools/s6-sudo.c
new file mode 100644
index 0000000..865b681
--- /dev/null
+++ b/src/conn-tools/s6-sudo.c
@@ -0,0 +1,67 @@
+/* ISC license. */
+
+#include <skalibs/uint.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <s6/config.h>
+
+#define USAGE "s6-sudo [ -q | -Q | -v ] [ -p bindpath ] [ -l localname ] [ -e ] [ -t timeout ] [ -T timeoutrun ] path [ args... ]"
+#define dieusage() strerr_dieusage(100, USAGE)
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  unsigned int verbosity = 1, t = 0, T = 0 ;
+  char const *bindpath = 0 ;
+  char const *localname = 0 ;
+  int nodoenv = 0 ;
+  PROG = "s6-sudo" ;
+  {
+    subgetopt_t l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      register int opt = subgetopt_r(argc, argv, "qQvp:l:et:T:", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'q' : if (verbosity) verbosity-- ; break ;
+        case 'Q' : verbosity = 1 ; break ;
+        case 'v' : verbosity++ ; break ;
+        case 'p' : bindpath = l.arg ; break ;
+        case 'l' : localname = l.arg ; break ;
+        case 'e' : nodoenv = 1 ; break ;
+        case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+        case 'T' : if (!uint0_scan(l.arg, &T)) dieusage() ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (!argc) dieusage() ;
+  {
+    char const *eargv[9 + argc + ((verbosity < 2 ? 1 : verbosity-1)) + ((!!bindpath + !!localname) << 1) + nodoenv] ;
+    char fmt1[UINT_FMT] ;
+    char fmt2[UINT_FMT] ;
+    unsigned int n = 0 ;
+    eargv[n++] = S6_BINPREFIX "s6-ipcclient" ;
+    if (!verbosity) eargv[n++] = "-Q" ;
+    else while (--verbosity) eargv[n++] = "-v" ;
+    if (bindpath) { eargv[n++] = "-p" ; eargv[n++] = bindpath ; }
+    if (localname) { eargv[n++] = "-l" ; eargv[n++] = localname ; }
+    eargv[n++] = "--" ;
+    eargv[n++] = *argv++ ; argc-- ;
+    eargv[n++] = S6_BINPREFIX "s6-sudoc" ;
+    if (nodoenv) eargv[n++] = "-e" ;
+    eargv[n++] = "-t" ;
+    fmt1[uint_fmt(fmt1, t)] = 0 ;
+    eargv[n++] = fmt1 ;
+    eargv[n++] = "-T" ;
+    fmt2[uint_fmt(fmt2, T)] = 0 ;
+    eargv[n++] = fmt2 ;
+    eargv[n++] = "--" ;
+    while (argc--) eargv[n++] = *argv++ ;
+    eargv[n++] = 0 ;
+    pathexec_run(eargv[0], eargv, envp) ;
+  }
+  strerr_dieexec(111, S6_BINPREFIX "s6-ipcclient") ;
+}
diff --git a/src/conn-tools/s6-sudo.h b/src/conn-tools/s6-sudo.h
new file mode 100644
index 0000000..8c5797f
--- /dev/null
+++ b/src/conn-tools/s6-sudo.h
@@ -0,0 +1,11 @@
+/* ISC license. */
+
+#ifndef S6_SUDO_H
+#define S6_SUDO_H
+
+#define S6_SUDO_BANNERB "s6-sudo b v1.0\n"
+#define S6_SUDO_BANNERB_LEN (sizeof(S6_SUDO_BANNERB) - 1)
+#define S6_SUDO_BANNERA "s6-sudo a v1.0\n"
+#define S6_SUDO_BANNERA_LEN (sizeof(S6_SUDO_BANNERA) - 1)
+
+#endif
diff --git a/src/conn-tools/s6-sudoc.c b/src/conn-tools/s6-sudoc.c
new file mode 100644
index 0000000..823d7cb
--- /dev/null
+++ b/src/conn-tools/s6-sudoc.c
@@ -0,0 +1,115 @@
+/* ISC license. */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <sys/wait.h>
+#include <skalibs/uint.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/buffer.h>
+#include <skalibs/stralloc.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/tai.h>
+#include <skalibs/env.h>
+#include <skalibs/unix-timed.h>
+#include <skalibs/unixmessage.h>
+#include "s6-sudo.h"
+
+#define USAGE "s6-sudoc [ -e ] [ -t timeoutconn ] [ -T timeoutrun ] [ args... ]"
+#define dieusage() strerr_dieusage(100, USAGE)
+#define dienomem() strerr_diefu1sys(111, "stralloc_catb")
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  char buf6[64] ;
+  buffer b6 = BUFFER_INIT(&buffer_read, 6, buf6, 64) ;
+  unixmessage_sender_t b7 = UNIXMESSAGE_SENDER_INIT(7) ;
+  subgetopt_t l = SUBGETOPT_ZERO ;
+  unsigned int t = 0, T = 0 ;
+  int doenv = 1 ;
+  
+  tain_t deadline = TAIN_INFINITE_RELATIVE ;
+  PROG = "s6-sudoc" ;
+  for (;;)
+  {
+    register int opt = subgetopt_r(argc, argv, "et:T:", &l) ;
+    if (opt < 0) break ;
+    switch (opt)
+    {
+      case 'e' : doenv = 0 ; break ;
+      case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+      case 'T' : if (!uint0_scan(l.arg, &T)) dieusage() ; break ;
+      default : dieusage() ;
+    }
+  }
+  argc -= l.ind ; argv += l.ind ;
+  if (t) tain_from_millisecs(&deadline, t) ;
+  if ((ndelay_on(6) < 0) || (ndelay_on(7) < 0))
+    strerr_diefu1sys(111, "make socket non-blocking") ;
+  if (!fd_sanitize() || !fd_ensure_open(2, 1))
+    strerr_diefu1sys(111, "sanitize stdin/stdout/stderr") ;
+
+  tain_now_g() ;
+  tain_add_g(&deadline, &deadline) ;
+  {
+    char tmp[S6_SUDO_BANNERB_LEN] ;
+    if (buffer_timed_get_g(&b6, tmp, S6_SUDO_BANNERB_LEN, &deadline) < S6_SUDO_BANNERB_LEN)
+      strerr_diefu1sys(111, "read banner from s6-sudod") ;
+    if (str_diffn(tmp, S6_SUDO_BANNERB, S6_SUDO_BANNERB_LEN))
+      strerr_dief1x(100, "wrong server banner") ;
+  }
+  {
+    int fds[3] = { 0, 1, 2 } ;
+    char pack[16] ;
+    siovec_t v[4] = {
+      { .s = S6_SUDO_BANNERA, .len = S6_SUDO_BANNERA_LEN },
+      { .s = pack, .len = 16 },
+      { .s = 0, .len = 0 },
+      { .s = 0, .len = 0 } } ;
+    unixmessage_v_t mv = { .v = v, .vlen = 4, .fds = fds, .nfds = 3 } ;
+    stralloc sa = STRALLOC_ZERO ;
+    unsigned int envlen = doenv ? env_len(envp) : 0 ;
+    uint32_pack_big(pack, (uint32)argc) ;
+    uint32_pack_big(pack + 4, (uint32)envlen) ;
+    if (!env_string(&sa, argv, argc)) dienomem() ;
+    v[2].len = sa.len ;
+    uint32_pack_big(pack + 8, (uint32)v[2].len) ;
+    if (doenv)
+    {
+      if (!env_string(&sa, envp, envlen)) dienomem() ;
+      v[3].len = sa.len - v[2].len ;
+    }
+    uint32_pack_big(pack + 12, (uint32)v[3].len) ;
+    v[2].s = sa.s ;
+    v[3].s = sa.s + v[2].len ;
+    if (!unixmessage_putv_and_close(&b7, &mv, (unsigned char const *)"\003"))
+      strerr_diefu1sys(111, "unixmessage_putv") ;
+    stralloc_free(&sa) ;
+  }
+  if (!unixmessage_sender_timed_flush_g(&b7, &deadline))
+    strerr_diefu1sys(111, "send args to server") ;
+  unixmessage_sender_free(&b7) ;
+  {
+    char c ;
+    if (buffer_timed_get_g(&b6, &c, 1, &deadline) < 1)
+      strerr_diefu1sys(111, "get confirmation from server") ;
+    if (c)
+    {
+      errno = c ;
+      strerr_diefu1sys(111, "start privileged program: server answered: ") ;
+    }
+  }
+
+  if (T) tain_from_millisecs(&deadline, T) ; else deadline = tain_infinite_relative ;
+  tain_add_g(&deadline, &deadline) ;
+  {
+    char pack[UINT_PACK] ;
+    if (buffer_timed_get_g(&b6, pack, UINT_PACK, &deadline) < UINT_PACK)
+      strerr_diefu1sys(111, "get exit status from server") ;
+    uint_unpack_big(pack, &t) ;
+  }
+  if (WIFSIGNALED(t)) raise(WTERMSIG(t)) ;
+  return WEXITSTATUS(t) ;
+}
diff --git a/src/conn-tools/s6-sudod.c b/src/conn-tools/s6-sudod.c
new file mode 100644
index 0000000..8c52bb9
--- /dev/null
+++ b/src/conn-tools/s6-sudod.c
@@ -0,0 +1,233 @@
+/* ISC license. */
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <skalibs/uint.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/buffer.h>
+#include <skalibs/stralloc.h>
+#include <skalibs/strerr2.h>
+#include <skalibs/tai.h>
+#include <skalibs/iopause.h>
+#include <skalibs/selfpipe.h>
+#include <skalibs/env.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/unix-timed.h>
+#include <skalibs/unixmessage.h>
+#include "s6-sudo.h"
+
+#define USAGE "s6-sudod [ -0 ] [ -1 ] [ -2 ] [ -t timeout ] args..."
+#define dieusage() strerr_dieusage(100, USAGE)
+#define dienomem() strerr_diefu1sys(111, "stralloc_catb")
+
+int main (int argc, char const *const *argv, char const *const *envp)
+{
+  subgetopt_t l = SUBGETOPT_ZERO ;
+  unixmessage_t m ;
+  unsigned int nullfds = 0, t = 2000 ;
+  pid_t pid ;
+  uint32 envc = env_len(envp) ;
+  uint32 cargc, cenvc, carglen, cenvlen ;
+  int spfd ;
+  tain_t deadline = TAIN_INFINITE_RELATIVE ;
+  PROG = "s6-sudod" ;
+  for (;;)
+  {
+    register int opt = subgetopt_r(argc, argv, "012t:", &l) ;
+    if (opt < 0) break ;
+    switch (opt)
+    {
+      case '0' : nullfds |= 1 ; break ;
+      case '1' : nullfds |= 2 ; break ;
+      case '2' : nullfds |= 4 ; break ;
+      case 't' : if (!uint0_scan(l.arg, &t)) dieusage() ; break ;
+      default : dieusage() ;
+    }
+  }
+  argc -= l.ind ; argv += l.ind ;
+  if (t) tain_from_millisecs(&deadline, t) ;
+  if ((ndelay_on(0) < 0) || (ndelay_on(1) < 0))
+    strerr_diefu1sys(111, "make socket non-blocking") ;
+
+  tain_now_g() ;
+  tain_add_g(&deadline, &deadline) ;
+  buffer_putnoflush(buffer_1small, S6_SUDO_BANNERB, S6_SUDO_BANNERB_LEN) ;
+  if (!buffer_timed_flush_g(buffer_1small, &deadline))
+    strerr_diefu1sys(111, "write banner to client") ;
+  if (unixmessage_timed_receive_g(unixmessage_receiver_0, &m, &deadline) <= 0)
+    strerr_diefu1sys(111, "read message from client") ;
+  if (m.nfds != 3)
+    strerr_dief1x(100, "client did not send 3 fds") ;
+  if (m.len < 16 + S6_SUDO_BANNERA_LEN)
+    strerr_dief1x(100, "wrong client message") ;
+  if (str_diffn(m.s, S6_SUDO_BANNERA, S6_SUDO_BANNERA_LEN))
+    strerr_dief1x(100, "wrong client banner") ;
+  uint32_unpack_big(m.s + S6_SUDO_BANNERA_LEN, &cargc) ;
+  uint32_unpack_big(m.s + S6_SUDO_BANNERA_LEN + 4, &cenvc) ;
+  uint32_unpack_big(m.s + S6_SUDO_BANNERA_LEN + 8, &carglen) ;
+  uint32_unpack_big(m.s + S6_SUDO_BANNERA_LEN + 12, &cenvlen) ;
+  if (S6_SUDO_BANNERA_LEN + 16 + carglen + cenvlen != m.len)
+    strerr_dief1x(100, "wrong client argc/envlen") ;
+  if ((cargc > 131072) || (cenvc > 131072))
+    strerr_dief1x(100, "too many args/envvars from client") ;
+
+  if (nullfds & 1)
+  {
+    close(m.fds[0]) ;
+    m.fds[0] = open2("/dev/null", O_RDONLY) ;
+    if (m.fds[0] < 0) strerr_diefu2sys(111, "open /dev/null for ", "reading") ;
+  }
+  if (nullfds & 2)
+  {
+    close(m.fds[1]) ;
+    m.fds[1] = open2("/dev/null", O_WRONLY) ;
+    if (m.fds[1] < 0) strerr_diefu2sys(111, "open /dev/null for ", "writing") ;
+  }
+  if (nullfds & 4)
+  {
+    close(m.fds[2]) ;
+    m.fds[2] = 2 ;
+  }
+ 
+  {
+    char const *targv[argc + 1 + cargc] ;
+    char const *tenvp[envc + 1 + cenvc] ;
+    int p[2] ;
+    register unsigned int i = 0 ;
+    for (; i < (unsigned int)argc ; i++) targv[i] = argv[i] ;
+    for (i = 0 ; i <= envc ; i++) tenvp[i] = envp[i] ;
+    if (!env_make(targv + argc, cargc, m.s + S6_SUDO_BANNERA_LEN + 16, carglen))
+    {
+      char c = errno ;
+      buffer_putnoflush(buffer_1small, &c, 1) ;
+      buffer_timed_flush_g(buffer_1small, &deadline) ;
+      errno = c ;
+      strerr_diefu1sys(111, "make child argv") ;
+    }
+    if (!env_make(tenvp + envc + 1, cenvc, m.s + S6_SUDO_BANNERA_LEN + 16 + carglen, cenvlen))
+    {
+      char c = errno ;
+      buffer_putnoflush(buffer_1small, &c, 1) ;
+      buffer_timed_flush_g(buffer_1small, &deadline) ;
+      errno = c ;
+      strerr_diefu1sys(111, "make child envp") ;
+    }
+    targv[argc + cargc] = 0 ;
+
+    for (i = 0 ; i < cenvc ; i++)
+    {
+      char const *var = tenvp[envc + 1 + i] ;
+      register unsigned int j = 0 ;
+      register unsigned int len = str_chr(var, '=') ;
+      if (!var[len])
+      {
+        char c = EINVAL ;
+        buffer_putnoflush(buffer_1small, &c, 1) ;
+        buffer_timed_flush_g(buffer_1small, &deadline) ;
+        strerr_dief1x(100, "bad environment from client") ;
+      }
+      for (; j < envc ; j++) if (!str_diffn(var, tenvp[j], len+1)) break ;
+      if ((j < envc) && !tenvp[j][len+1]) tenvp[j] = var ;
+    }
+
+    spfd = selfpipe_init() ;
+    if (spfd < 0) strerr_diefu1sys(111, "selfpipe_init") ;
+    if (selfpipe_trap(SIGCHLD) < 0) strerr_diefu1sys(111, "trap SIGCHLD") ;
+    if (pipe(p) < 0) strerr_diefu1sys(111, "pipe") ;
+    if (coe(p[1]) < 0) strerr_diefu1sys(111, "coe pipe") ;
+    pid = fork() ;
+    if (pid < 0) strerr_diefu1sys(111, "fork") ;
+    if (!pid)
+    {
+      PROG = "s6-sudod (child)" ;
+      fd_close(p[0]) ;
+      if ((fd_move(2, m.fds[2]) < 0)
+       || (fd_move(1, m.fds[1]) < 0)
+       || (fd_move(0, m.fds[0]) < 0))
+      {
+        char c = errno ;
+        fd_write(p[1], &c, 1) ;
+        strerr_diefu1sys(111, "move fds") ;
+      }
+      selfpipe_finish() ;
+      pathexec0_run(targv, tenvp) ;
+      {
+        char c = errno ;
+        fd_write(p[1], &c, 1) ;
+      }
+      strerr_dieexec(111, targv[0]) ;
+    }
+    fd_close(p[1]) ;
+    {
+      char c ;
+      register int r = fd_read(p[0], &c, 1) ;
+      if (r < 0) strerr_diefu1sys(111, "read from child") ;
+      if (r)
+      {
+        buffer_putnoflush(buffer_1small, &c, 1) ;
+        buffer_timed_flush_g(buffer_1small, &deadline) ;
+        return 111 ;
+      }
+    }
+    fd_close(p[0]) ;
+  }
+
+  fd_close(m.fds[0]) ;
+  fd_close(m.fds[1]) ;
+  if (!(nullfds & 4)) fd_close(m.fds[2]) ;
+  unixmessage_receiver_free(unixmessage_receiver_0) ;
+  buffer_putnoflush(buffer_1small, "", 1) ;
+  if (!buffer_timed_flush_g(buffer_1small, &deadline))
+    strerr_diefu1sys(111, "send confirmation to client") ;
+
+  {
+    iopause_fd x[2] = { { .fd = 0, .events = 0 }, { .fd = spfd, .events = IOPAUSE_READ } } ;
+    int cont = 1 ;
+    while (cont)
+    {
+      if (iopause_g(x, 2, 0) < 0) strerr_diefu1sys(111, "iopause") ;
+      if (x[1].revents)
+      {
+        for (;;)
+        {
+          int c = selfpipe_read() ;
+          if (c < 0) strerr_diefu1sys(111, "read from selfpipe") ;
+          else if (!c) break ;
+          else if (c == SIGCHLD)
+          {
+            int wstat ;
+            register int r = wait_pid_nohang(pid, &wstat) ;
+            if ((r < 0) && (errno != ECHILD))
+              strerr_diefu1sys(111, "wait_pid_nohang") ;
+            else if (r > 0)
+            {
+              char pack[UINT_PACK] ;
+              uint_pack_big(pack, (unsigned int)wstat) ;
+              buffer_putnoflush(buffer_1small, pack, UINT_PACK) ;
+              cont = 0 ;
+            }
+          }
+          else
+            strerr_dief1sys(101, "internal inconsistency, please submit a bug-report") ;
+        }
+      }
+      if (x[0].revents && cont)
+      {
+        kill(pid, SIGTERM) ;
+        kill(pid, SIGCONT) ;
+        x[0].fd = -1 ;
+        return 1 ;
+      }
+    }
+  }
+  if (ndelay_off(1) < 0)
+    strerr_diefu1sys(111, "set stdout blocking") ;
+  if (!buffer_flush(buffer_1small))
+    strerr_diefu1sys(111, "write status to client") ;
+  return 0 ;
+}