From 97b95055eaa2de527dc1a75f1c9973afbd07410e Mon Sep 17 00:00:00 2001
From: oetiker <oetiker@a5681a0c-68f1-0310-ab6d-d61299d08faa>
Date: Mon, 22 Mar 2010 14:49:26 +0000
Subject: [PATCH] rrdcached: Added -m command line option. This option may be
 used to specify the file permissions of a UNIX socket. The option affects the
 following sockets only, i.e., it's possible to specify different modes for
 different sockets. -- Sebastian Harl

git-svn-id: svn://svn.oetiker.ch/rrdtool/trunk/program@2035 a5681a0c-68f1-0310-ab6d-d61299d08faa
---
 doc/rrdcached.pod | 20 +++++++++++++++++++-
 src/rrd_daemon.c  | 34 +++++++++++++++++++++++++++++++---
 2 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/doc/rrdcached.pod b/doc/rrdcached.pod
index e2f7ed8..d6bfec3 100644
--- a/doc/rrdcached.pod
+++ b/doc/rrdcached.pod
@@ -68,7 +68,7 @@ C<unix:/tmp/rrdcached.sock>, will be used.
 
 =item B<-s> I<group_name>|I<gid>
 
-Set the group permissions of the UNIX domain socket. The option accepts either
+Set the group permissions of a UNIX domain socket. The option accepts either
 a numeric group id or group name. That group will then have both read and write
 permissions (the socket will have file permissions 0750) for the socket and,
 therefore, is able to send commands to the daemon. This
@@ -83,6 +83,24 @@ sockets.
 The default is not to change ownership or permissions of the socket and, thus,
 use the system default.
 
+=item B<-m> I<mode>
+
+Set the file permissions of a UNIX domain socket. The option accepts an octal
+number representing the bit pattern for the mode (see L<chmod(1)> for
+details).
+
+Please note that not all systems honor this setting. On Linux, read/write
+permissions are required to connect to a UNIX socket. However, many
+BSD-derived systems ignore permissions for UNIX sockets. See L<unix(7)> for
+details.
+
+This option affects the I<following> UNIX socket addresses (the following
+B<-l> options), i.e., you may specify different settings for different
+sockets.
+
+The default is not to change ownership or permissions of the socket and, thus,
+use the system default.
+
 =item B<-P> I<command>[,I<command>[,...]]
 
 Specifies the commands accepted via a network socket. This allows
diff --git a/src/rrd_daemon.c b/src/rrd_daemon.c
index 372adee..b290bcc 100644
--- a/src/rrd_daemon.c
+++ b/src/rrd_daemon.c
@@ -142,7 +142,8 @@ struct listen_socket_s
 
   uint32_t permissions;
 
-  gid_t socket_group;
+  gid_t  socket_group;
+  mode_t socket_permissions;
 };
 typedef struct listen_socket_s listen_socket_t;
 
@@ -2339,6 +2340,13 @@ static int open_listen_socket_unix (const listen_socket_t *sock) /* {{{ */
     }
   }
 
+  if (sock->socket_permissions != (mode_t)-1)
+  {
+    if (chmod(path, sock->socket_permissions) != 0)
+      fprintf(stderr, "rrdcached: failed to set socket file permissions (%o): %s\n",
+          (unsigned int)sock->socket_permissions, strerror(errno));
+  }
+
   status = listen (fd, /* backlog = */ 10);
   if (status != 0)
   {
@@ -2759,9 +2767,10 @@ static int read_options (int argc, char **argv) /* {{{ */
   char **permissions = NULL;
   size_t permissions_len = 0;
 
-  gid_t socket_group = (gid_t)-1;
+  gid_t  socket_group = (gid_t)-1;
+  mode_t socket_permissions = (mode_t)-1;
 
-  while ((option = getopt(argc, argv, "gl:s:P:f:w:z:t:Bb:p:Fj:h?")) != -1)
+  while ((option = getopt(argc, argv, "gl:s:m:P:f:w:z:t:Bb:p:Fj:h?")) != -1)
   {
     switch (option)
     {
@@ -2818,6 +2827,7 @@ static int read_options (int argc, char **argv) /* {{{ */
         /* }}} Done adding permissions. */
 
         new->socket_group = socket_group;
+        new->socket_permissions = socket_permissions;
 
         if (!rrd_add_ptr((void ***)&config_listen_address_list,
                          &config_listen_address_list_len, new))
@@ -2858,6 +2868,24 @@ static int read_options (int argc, char **argv) /* {{{ */
       }
       break;
 
+      /* set socket file permissions */
+      case 'm':
+      {
+        long  tmp;
+        char *endptr = NULL;
+
+        tmp = strtol (optarg, &endptr, 8);
+        if ((endptr == optarg) || (! endptr) || (*endptr != '\0')
+            || (tmp > 07777) || (tmp < 0)) {
+          fprintf (stderr, "read_options: Invalid file mode \"%s\".\n",
+              optarg);
+          return (5);
+        }
+
+        socket_permissions = (mode_t)tmp;
+      }
+      break;
+
       case 'P':
       {
         char *optcopy;
-- 
2.11.0