Download this file
| 1 | //go:build linux |
| 2 | |
| 3 | package instancectl |
| 4 | |
| 5 | import ( |
| 6 | "fmt" |
| 7 | "net" |
| 8 | "os" |
| 9 | |
| 10 | "github.com/carlosframework/platform/internal/safefile" |
| 11 | "golang.org/x/sys/unix" |
| 12 | ) |
| 13 | |
| 14 | func claimListenExecSocket(source string) (*net.UnixListener, error) { |
| 15 | dir, err := safefile.OpenDir(source) |
| 16 | if err != nil { |
| 17 | return nil, err |
| 18 | } |
| 19 | defer dir.Close() |
| 20 | var parent unix.Stat_t |
| 21 | if err := unix.Fstat(int(dir.Fd()), &parent); err != nil { |
| 22 | return nil, err |
| 23 | } |
| 24 | if parent.Uid != uint32(os.Geteuid()) || parent.Mode&0022 != 0 { |
| 25 | return nil, ErrClaimUnit |
| 26 | } |
| 27 | path := fmt.Sprintf("/proc/self/fd/%d/exec.sock", dir.Fd()) |
| 28 | ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: path, Net: "unix"}) |
| 29 | if err != nil { |
| 30 | return nil, err |
| 31 | } |
| 32 | ln.SetUnlinkOnClose(false) |
| 33 | fail := func(err error) (*net.UnixListener, error) { ln.Close(); return nil, err } |
| 34 | fd, err := unix.Openat(int(dir.Fd()), "exec.sock", unix.O_PATH|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0) |
| 35 | if err != nil { |
| 36 | return fail(err) |
| 37 | } |
| 38 | defer unix.Close(fd) |
| 39 | var st unix.Stat_t |
| 40 | if err := unix.Fstat(fd, &st); err != nil { |
| 41 | return fail(err) |
| 42 | } |
| 43 | if st.Mode&unix.S_IFMT != unix.S_IFSOCK || st.Uid != uint32(os.Geteuid()) { |
| 44 | return fail(ErrClaimUnit) |
| 45 | } |
| 46 | if err := unix.Fchmodat(fd, "", 0666, unix.AT_EMPTY_PATH); err != nil { |
| 47 | return fail(err) |
| 48 | } |
| 49 | return ln, nil |
| 50 | } |
| 51 | |
amadan