sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-20 21:59:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Bind the daemon unix sockets at their final mode so no chmod follows the bind

Browse Source
This commit is contained in:
Viktor Liu
2026-09-09 11:47:22 +02:00
parent ed63bf71dd
commit 5d7fb3288b
4 changed files with 70 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/cmd/service_socket.go
+5 -6
View File
@@ -52,12 +52,11 @@ func listenOnAddress(addr string, allowed []string) (*socketListener, error) {
removeStaleUnixSocket(address)
// A Unix socket accepts connections the moment it is bound, and the
// kernel checks its mode at connect() rather than at accept(). Creating
// it owner-only closes the window between the bind and applySocketAccess:
// without this, a permissive umask leaves the socket open to everybody
// for that interval, and a caller that got in stays connected after the
// mode is narrowed.
listener, err := listenUnixPrivate(address)
// kernel checks its mode at connect() rather than at accept(), so the
// socket is bound at the narrowest mode the configuration allows rather
// than bound wide and narrowed after: a caller that gets in during such
// a window stays connected once the mode changes.
listener, err := listenUnixPrivate(address, allowed)
if err != nil {
return nil, err
}