Skip to content

Commit

Permalink
fix: allow group and other access to Unix socket (#136)
Browse files Browse the repository at this point in the history
  • Loading branch information
enocom authored Sep 21, 2022
1 parent 80ac55d commit 5649176
Show file tree
Hide file tree
Showing 4 changed files with 67 additions and 0 deletions.
7 changes: 7 additions & 0 deletions internal/proxy/proxy.go
Original file line number Diff line number Diff line change
Expand Up @@ -548,6 +548,13 @@ func newSocketMount(ctx context.Context, conf *Config, pc *portConfig, inst Inst
if err != nil {
return nil, err
}
// Change file permisions to allow access for user, group, and other.
if network == "unix" {
// Best effort. If this call fails, group and other won't have write
// access.
_ = os.Chmod(address, 0777)
}

m := &socketMount{inst: inst.Name, listener: ln}
return m, nil
}
Expand Down
33 changes: 33 additions & 0 deletions internal/proxy/proxy_other_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build !windows
// +build !windows

package proxy_test

import (
"os"
"testing"
)

func verifySocketPermissions(t *testing.T, addr string) {
fi, err := os.Stat(addr)
if err != nil {
t.Fatalf("os.Stat(%v): %v", addr, err)
}
if fm := fi.Mode(); fm != 0777|os.ModeSocket {
t.Fatalf("file mode: want = %v, got = %v", 0777|os.ModeSocket, fm)
}
}
2 changes: 2 additions & 0 deletions internal/proxy/proxy_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,8 @@ func TestClientInitialization(t *testing.T) {
}

for _, addr := range tc.wantUnixAddrs {
verifySocketPermissions(t, addr)

conn, err := net.Dial("unix", addr)
if err != nil {
t.Fatalf("want error = nil, got = %v", err)
Expand Down
25 changes: 25 additions & 0 deletions internal/proxy/proxy_windows_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package proxy_test

import (
"testing"
)

func verifySocketPermissions(t *testing.T, addr string) {
// On Linux and Darwin, we check that the socket named by addr exists with
// os.Stat. That operation is not supported on Windows.
// See https://github.com/microsoft/Windows-Containers/issues/97#issuecomment-887713195
}

0 comments on commit 5649176

Please sign in to comment.