sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-16 03:39:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refuse to serve when a configured socket restriction cannot be applied

Browse Source
This commit is contained in:
Viktor Liu
2026-09-09 06:15:38 +02:00
parent 72bf5adad7
commit 1db3c7bf13
3 changed files with 63 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/cmd/service_controller.go
+8 -5
View File
@@ -155,14 +155,17 @@ func (p *program) serve(daemonListener, jsonListener *socketListener, allowed []
defer jsonListener.Close()
}
// restrict is a no-op for a nil listener and for a non-unix one.
// Returned rather than logged: a socket whose access could not be set is
// either open to accounts that must not reach the daemon, or unreachable by
// the ones that must. Both are worse than the caller's fatal exit, and
// swallowing this would leave a service the manager still reports as running
// with no usable socket. restrict is a no-op for a nil listener, which is
// what a disabled JSON socket is.
if err := daemonListener.restrict("daemon", allowed); err != nil {
log.Error(err)
return nil
return err
}
if err := jsonListener.restrict("daemon JSON", allowed); err != nil {
log.Error(err)
return nil
return err
}
serverInstance := server.New(p.ctx, util.FindFirstLogPath(logFiles), configPath, profilesDisabled, updateSettingsDisabled, captureEnabled, networksDisabled)