Previously sanlk-resetd socket used an abstract namespace, allowing any
user to configure the daemon. Now we use a real filename so accessing
the socket is possible only for privileged user.
Signed-off-by: Nir Soffer <nsoffer(a)redhat.com>
---
reset/sanlk_reset.c | 2 +-
reset/sanlk_reset.h | 8 +++++---
reset/sanlk_resetd.c | 15 ++++++++++++++-
3 files changed, 20 insertions(+), 5 deletions(-)
diff --git a/reset/sanlk_reset.c b/reset/sanlk_reset.c
index ddd7af2..34b66af 100644
--- a/reset/sanlk_reset.c
+++ b/reset/sanlk_reset.c
@@ -439,7 +439,7 @@ static int update_local_daemon(char *cmd)
rv = sendto(s, buf, UPDATE_SIZE, 0, (struct sockaddr *)&update_addr,
update_addrlen);
if (rv < 0) {
- printf("Failed to update local sanlk-resetd %d\n", rv);
+ printf("Failed to update local sanlk-resetd: %s\n", strerror(errno));
return rv;
} else {
printf("Updated %s %s\n", cmd, ls_names[i]);
diff --git a/reset/sanlk_reset.h b/reset/sanlk_reset.h
index f386301..8c92c8e 100644
--- a/reset/sanlk_reset.h
+++ b/reset/sanlk_reset.h
@@ -14,7 +14,9 @@
#define EVENT_REBOOT 4
#define EVENT_REBOOTING 8
-#define SANLK_RESETD_PATH "sanlk-resetd"
+#define SANLK_RESETD_RUNDIR "/var/run/sanlk-resetd"
+#define SANLK_RESETD_SOCKET SANLK_RESETD_RUNDIR "/sanlk-resetd.sock"
+#define SANLK_RESETD_SOCKET_MODE (S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP)
#define UPDATE_SIZE 256 /* sendmsg size on unix socket */
@@ -28,8 +30,8 @@ static inline int setup_resetd_socket(void)
memset(&update_addr, 0, sizeof(update_addr));
update_addr.sun_family = AF_LOCAL;
- strcpy(&update_addr.sun_path[1], SANLK_RESETD_PATH);
- update_addrlen = sizeof(sa_family_t) + strlen(update_addr.sun_path+1) + 1;
+ strcpy(update_addr.sun_path, SANLK_RESETD_SOCKET);
+ update_addrlen = sizeof(sa_family_t) + strlen(update_addr.sun_path) + 1;
return s;
}
diff --git a/reset/sanlk_resetd.c b/reset/sanlk_resetd.c
index 0c0c0f8..1f00144 100644
--- a/reset/sanlk_resetd.c
+++ b/reset/sanlk_resetd.c
@@ -430,14 +430,27 @@ static int setup_update(void)
{
int s, rv;
+ rv = mkdir(SANLK_RESETD_RUNDIR, 0755);
+ if (rv < 0 && errno != EEXIST)
+ return rv;
+
s = setup_resetd_socket();
+ unlink(update_addr.sun_path);
rv = bind(s, (struct sockaddr *) &update_addr, update_addrlen);
if (rv < 0)
- return rv;
+ goto fail_close;
+
+ rv = chmod(update_addr.sun_path, SANLK_RESETD_SOCKET_MODE);
+ if (rv < 0)
+ goto fail_close;
update_fd = s;
return 0;
+
+fail_close:
+ close(s);
+ return -1;
}
static void process_update(int fd)
--
1.8.3.1