rrdcached: Added -m command line option. This option may be used to specify

the file permissions of a UNIX socket. The option affects the following
sockets only, i.e., it's possible to specify different modes for different
sockets. -- Sebastian Harl

git-svn-id: svn://svn.oetiker.ch/rrdtool/trunk/program@2035 a5681a0c-68f1-0310-ab6d-d61299d08faa

diff --git a/doc/rrdcached.pod b/doc/rrdcached.pod
index e2f7ed8..d6bfec3 100644 (file)
--- a/doc/rrdcached.pod
+++ b/doc/rrdcached.pod
@@ -68,7 +68,7 @@ C<unix:/tmp/rrdcached.sock>, will be used.
 
 =item B<-s> I<group_name>|I<gid>
 
-Set the group permissions of the UNIX domain socket. The option accepts either
+Set the group permissions of a UNIX domain socket. The option accepts either
 a numeric group id or group name. That group will then have both read and write
 permissions (the socket will have file permissions 0750) for the socket and,
 therefore, is able to send commands to the daemon. This
@@ -83,6 +83,24 @@ sockets.
 The default is not to change ownership or permissions of the socket and, thus,
 use the system default.
 
+=item B<-m> I<mode>
+
+Set the file permissions of a UNIX domain socket. The option accepts an octal
+number representing the bit pattern for the mode (see L<chmod(1)> for
+details).
+
+Please note that not all systems honor this setting. On Linux, read/write
+permissions are required to connect to a UNIX socket. However, many
+BSD-derived systems ignore permissions for UNIX sockets. See L<unix(7)> for
+details.
+
+This option affects the I<following> UNIX socket addresses (the following
+B<-l> options), i.e., you may specify different settings for different
+sockets.
+
+The default is not to change ownership or permissions of the socket and, thus,
+use the system default.
+
 =item B<-P> I<command>[,I<command>[,...]]
 
 Specifies the commands accepted via a network socket. This allows

diff --git a/src/rrd_daemon.c b/src/rrd_daemon.c
index 372adee..b290bcc 100644 (file)
--- a/src/rrd_daemon.c
+++ b/src/rrd_daemon.c
@@ -142,7 +142,8 @@ struct listen_socket_s
 
   uint32_t permissions;
 
-  gid_t socket_group;
+  gid_t  socket_group;
+  mode_t socket_permissions;
 };
 typedef struct listen_socket_s listen_socket_t;
 
@@ -2339,6 +2340,13 @@ static int open_listen_socket_unix (const listen_socket_t *sock) /* {{{ */
     }
   }
 
+  if (sock->socket_permissions != (mode_t)-1)
+  {
+    if (chmod(path, sock->socket_permissions) != 0)
+      fprintf(stderr, "rrdcached: failed to set socket file permissions (%o): %s\n",
+          (unsigned int)sock->socket_permissions, strerror(errno));
+  }
+
   status = listen (fd, /* backlog = */ 10);
   if (status != 0)
   {
@@ -2759,9 +2767,10 @@ static int read_options (int argc, char **argv) /* {{{ */
   char **permissions = NULL;
   size_t permissions_len = 0;
 
-  gid_t socket_group = (gid_t)-1;
+  gid_t  socket_group = (gid_t)-1;
+  mode_t socket_permissions = (mode_t)-1;
 
-  while ((option = getopt(argc, argv, "gl:s:P:f:w:z:t:Bb:p:Fj:h?")) != -1)
+  while ((option = getopt(argc, argv, "gl:s:m:P:f:w:z:t:Bb:p:Fj:h?")) != -1)
   {
     switch (option)
     {
@@ -2818,6 +2827,7 @@ static int read_options (int argc, char **argv) /* {{{ */
         /* }}} Done adding permissions. */
 
         new->socket_group = socket_group;
+        new->socket_permissions = socket_permissions;
 
         if (!rrd_add_ptr((void ***)&config_listen_address_list,
                          &config_listen_address_list_len, new))
@@ -2858,6 +2868,24 @@ static int read_options (int argc, char **argv) /* {{{ */
       }
       break;
 
+      /* set socket file permissions */
+      case 'm':
+      {
+        long  tmp;
+        char *endptr = NULL;
+
+        tmp = strtol (optarg, &endptr, 8);
+        if ((endptr == optarg) || (! endptr) || (*endptr != '\0')
+            || (tmp > 07777) || (tmp < 0)) {
+          fprintf (stderr, "read_options: Invalid file mode \"%s\".\n",
+              optarg);
+          return (5);
+        }
+
+        socket_permissions = (mode_t)tmp;
+      }
+      break;
+
       case 'P':
       {
         char *optcopy;