Re: [PATCH 4/6] Don't change socket ownership

[Nir Soffer]

On Sun, Nov 27, 2022 at 7:39 PM Nir Soffer  wrote:
> We bind the socket after dropping privileges so the socket is already
> owned by the current user and group and there is no need to change
> ownership.
>
> This works when running in unprivileged mode locally but fails on Ubuntu
> CI:
> Using non-standard run directory '/tmp/sanlock'
> Running in unprivileged mode uid=1001 gid=1001
> sanlock daemon started 3.8.5 host
>
> 64b4f365-e153-4e0f-b4bf-c462c37739e7.fv-az41-301 (fv-az41-301)
>     could not set socket /tmp/sanlock/sanlock.sock permissions: Operation
> not permitted
> Signed-off-by: Nir Soffer
>
> src/main.c | 7 -------
>  1 file changed, 7 deletions(-)
>
> diff --git a/src/main.c b/src/main.c
> index f0182b6..3944452 100644
> --- a/src/main.c
> +++ b/src/main.c
> @@ -1385,27 +1385,20 @@ static int setup_listener(void)
>     unlink(addr.sun_path);
>     rv = bind(fd, (struct sockaddr *) &addr, sizeof(struct
>
> sockaddr_un));
>         if (rv < 0)
>                 goto exit_fail;
>     rv = chmod(addr.sun_path, DEFAULT_SOCKET_MODE);
>     if (rv < 0)
>             goto exit_fail;
>
>   rv = chown(addr.sun_path, com.uid, com.gid);
>   if (rv < 0) {
>           log_error("could not set socket %s permissions: %s",
>                   addr.sun_path, strerror(errno));
>           goto exit_fail;
>   }

This was added in

commit d8805d428ff7c8994a43cc5265eb5379f4db1057
Author: Federico Simoncelli 
Date:   Wed Apr 20 13:59:33 2011 +0100

daemon: configurable socket permissions

When it was added sanlock did not dropped privileges.

We started to drop privileges in:

commit 5c51530b5bccb8cfadc8a8591558b9ab99b95cb3
Author: Federico Simoncelli 
Date:   Wed Jul 18 12:44:15 2012 -0500

daemon: drop root privileges and use the helper

Since that commit, chown() is called from the user running sanlock, trying
to change
the ownership to the same uid/gid.

-
>     rv = listen(fd, 5);
>     if (rv < 0)
>             goto exit_fail;
>
>     fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);
>
>     ci = client_add(fd, process_listener, NULL);
>     if (ci < 0)
>             goto exit_fail;
>
> --
> 2.38.1