This repository was archived by the owner on Nov 23, 2017. It is now read-only.
Repository navigation
This repository was archived by the owner on Nov 23, 2017. It is now read-only.
set unix socket permissions during binding of the UNIX-socket #426
Description
Activity
Any news?
Hm. I did not work on this. Someone should choose a way of solving this issue.
@socketpair Do you have any suggestion on this? Changing the socket permission from outside can make it works but just temporarily, as long as the application is restarted the permission is lost and process like nginx (with www-data user) cannot connect anymore.
Well.
I do not understand what you mean as "outside". Anyway, too broad permission is a security bug. If appliation is restarted, UNIX-socket is recreated (re-bound) and this code will fire again.
Variant 1 will looks like:
def do_bind(sk, addr, mode): pid = os.fork() if pid == 0: try: os.umask(~mode & 0o777) sk.bind(addr) except: os._exit(1) else: os._exit(0) (pid, status) = os.waitpid(pid, 0) if status: raise RuntimeError('Failed to bind the socket.')
Variant 2 is not atomic.
Variant 3 (since asyncio now is a port of CPython): Do that under GIL locked in C. But anyway this will affect third-party threads.
Unfortunatelly this is not so easy.
os.fchmod(socket.fileno())BEFOREbind()+ setumaskto proper value. Since umask is not thread safe (affect all threads) that action should be done infork()...os.chmod(path)after binding. But this will leave socket with wrong permissions during small amount of time.Socket write permissions are required in order unprivileged process to connect to it.