Project

General

Profile

Feature #3018

Set UID+GID for server.bind unix socket

Added by VBKesha about 1 month ago. Updated about 1 month ago.

Status:
Wontfix
Priority:
Low
Category:
-
Target version:
-
ASK QUESTIONS IN Forums:
No

Description

Now we can set only permission on binded unix socket socket
But i need to set uid/gid for this socket.
I create little pacth maybe he will be useful to someone else.


Files

base.h_dif (81 Bytes) base.h_dif VBKesha, 2020-07-03 09:04
configfile.c_diff (1.23 KB) configfile.c_diff VBKesha, 2020-07-03 09:04
network.c_diff (1.14 KB) network.c_diff VBKesha, 2020-07-03 09:04
server.c_diff (122 Bytes) server.c_diff VBKesha, 2020-07-03 09:04
ligthttpd_chown.diff (5.74 KB) ligthttpd_chown.diff VBKesha, 2020-07-03 13:03
#1

Updated by stbuehler about 1 month ago

When submitting patches:

  • use unified diffs (diff -u, git diff will work too)
  • submit "one change" (multiple files, but one logical change as ni "feature" or "fix") in one file with proper .diff or .patch extension (git format-patch works well if you committed the fix locally, diff -ru if you have a separate directory with the original source)
#2

Updated by VBKesha about 1 month ago

diff one file

#3

Updated by gstrauss about 1 month ago

  • Status changed from New to Wontfix
  • Priority changed from Normal to Low
  • Target version deleted (1.4.x)

Thank you for your suggestion, but there is already a simple solution: run the backend service independently from lighttpd and have the backend service create the socket with desired ownership, rather than having lighttpd do so.

[Edit: I misread the patch; it is not for a backend. Still, there are external solutions, such as running lighttpd as the target user and creating the socket within a directory containing appropriately restricted permissions, or having systemd socket activation create the listening socket with the desired permissions.]

Since you submitted some code, here is some feedback on the code, though your code will not be accepted into lighttpd:
  • before flinging code at another site, it is often a good idea to ask questions in the forums to find out the feasibility of the patch
  • before flinging code at another site, it is often a good idea to see if someone else has already done what you are trying to do
    - someone made a similar suggestion in 2017 for lighttpd 1.4.46: https://pastebin.com/1xgUMaGS
  • before flinging code at another site, take a look to see how contributions are accepted
    - as stbuehler noted, a unified diff is required here (and you subsequently attached one, so thank you). I have never seen .h_dif or .c_diff file extensions.
  • your code is unix-centric without making appropriate compile time tests. <pwd.h> and <grp.h> headers might not be present, and subsequently their associated function calls
    - e.g. lighttpd server.c tests #ifdef HAVE_PWD_H
  • your code is unix-centric and assumes lighttpd is running root, but does not check that
    - e.g. lighttpd server.c tests #ifdef HAVE_GETUID and checks (0 == getuid())
  • your code has numerous simple mistakes, which is sloppy for such a small patch
    - your code issues log trace but fails to emit a fatal error if getpwnam, getgrnam, or chown fail. That is a clear failure in secure coding practices.
    - your code makes a mistake in its checking, which can lead to a server crash at startup when s->socket_user or s->socket_group are not set.
    if ((!buffer_string_is_empty(s->socket_perms)) && (!buffer_string_is_empty(s->socket_perms))){
    I think you meant if ((!buffer_string_is_empty(s->socket_user)) && (!buffer_string_is_empty(s->socket_group))){
    (It is clear that you did not test your code without those directives set)
    - your code has multiple obvious whitespace inconsistencies
    - your code has one misspelling of "unabe" ("unable")

I create little pacth maybe he will be useful to someone else.

Please post such things to the Forums. See that "Forums" tab at the top of the page.

If you would like to discuss this further, please post in the Forums and reference this page. Further posts here may be ignored.

#4

Updated by gstrauss about 1 month ago

x-ref: #656 Feature request: add server config for setting permissions on Unix domain socket

Also available in: Atom