mirrors/versitygw
1
0
Fork 0
mirror of https://github.com/versity/versitygw.git synced 2026-09-07 00:26:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add --socket-perm option for UNIX socket file permissions

Browse Source 
Add a --socket-perm flag (VGW_SOCKET_PERM env var) to control the
file-mode permissions on file-backed UNIX domain sockets. This allows
operators to limit access permission without relying on process umask.
The option applies to S3, admin, and WebUI sockets and has no effect
on TCP/IP addresses or Linux abstract namespace sockets.

Fixes #2010
This commit is contained in:
Ben McClelland
2026-04-20 19:07:08 -07:00
parent 7b65d744e6
commit 0dc074acbf
7 changed files with 97 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
s3api/admin-server.go
+11 -2
View File
@@ -17,6 +17,7 @@ package s3api
import (
"fmt"
"net"
"os"
"github.com/gofiber/fiber/v2"
"github.com/gofiber/fiber/v2/middleware/logger"
@@ -40,6 +41,7 @@ type S3AdminServer struct {
corsAllowOrigin string
maxConnections int
maxRequests int
socketPerm os.FileMode
}
func NewAdminServer(be backend.Backend, root middlewares.RootUserConfig, region string, iam auth.IAMService, l s3log.AuditLogger, ctrl controllers.S3ApiController, opts ...AdminOpt) *S3AdminServer {
@@ -124,6 +126,13 @@ func WithAdminConcurrencyLimiter(maxConnections, maxRequests int) AdminOpt {
}
}
// WithAdminSocketPerm sets the file-mode permissions applied to file-backed
// UNIX domain sockets after binding. It has no effect on TCP/IP or abstract
// namespace sockets.
func WithAdminSocketPerm(perm os.FileMode) AdminOpt {
return func(s *S3AdminServer) { s.socketPerm = perm }
}
// ServeMultiPort creates listeners for multiple port specifications and serves
// on all of them simultaneously. This supports listening on multiple ports and/or
// addresses (e.g., [":8080", "localhost:8081"]).
@@ -140,9 +149,9 @@ func (sa *S3AdminServer) ServeMultiPort(ports []string) error {
var err error
if sa.CertStorage != nil {
ln, err = utils.NewMultiAddrTLSListener(sa.app.Config().Network, portSpec, sa.CertStorage.GetCertificate)
ln, err = utils.NewMultiAddrTLSListener(sa.app.Config().Network, portSpec, sa.CertStorage.GetCertificate, utils.ListenerOptions{SocketPerm: sa.socketPerm})
} else {
ln, err = utils.NewMultiAddrListener(sa.app.Config().Network, portSpec)
ln, err = utils.NewMultiAddrListener(sa.app.Config().Network, portSpec, utils.ListenerOptions{SocketPerm: sa.socketPerm})
}
if err != nil {
s3api/server.go
+11 -2
View File
@@ -19,6 +19,7 @@ import (
"fmt"
"net"
"net/http"
"os"
"strings"
"time"
@@ -54,6 +55,7 @@ type S3ApiServer struct {
maxRequests int
webuiMountPrefix string
webuiSrvCfg *webui.ServerConfig
socketPerm os.FileMode
}
func New(
@@ -217,6 +219,13 @@ func WithConcurrencyLimiter(maxConnections, maxRequests int) Option {
}
}
// WithSocketPerm sets the file-mode permissions applied to file-backed UNIX
// domain sockets after binding. It has no effect on TCP/IP or abstract
// namespace sockets.
func WithSocketPerm(perm os.FileMode) Option {
return func(s *S3ApiServer) { s.socketPerm = perm }
}
// WithDisableACL disables the s3 api server ACLs, by ignoring all
// bucket/object ACL headers
func WithDisableACL() Option {
@@ -239,9 +248,9 @@ func (sa *S3ApiServer) ServeMultiPort(ports []string) error {
var err error
if sa.CertStorage != nil {
ln, err = utils.NewMultiAddrTLSListener(sa.app.Config().Network, portSpec, sa.CertStorage.GetCertificate)
ln, err = utils.NewMultiAddrTLSListener(sa.app.Config().Network, portSpec, sa.CertStorage.GetCertificate, utils.ListenerOptions{SocketPerm: sa.socketPerm})
} else {
ln, err = utils.NewMultiAddrListener(sa.app.Config().Network, portSpec)
ln, err = utils.NewMultiAddrListener(sa.app.Config().Network, portSpec, utils.ListenerOptions{SocketPerm: sa.socketPerm})
}
if err != nil {
return fmt.Errorf("failed to bind s3 listener %s: %w", portSpec, err)
s3api/utils/multi_listener.go
+29 -2
View File
@@ -272,6 +272,15 @@ func resolveHostnameAddrs(address string) ([]string, error) {
return addrs, nil
}
// ListenerOptions configures optional behaviour for NewMultiAddrListener and
// NewMultiAddrTLSListener.
type ListenerOptions struct {
// SocketPerm, when non-zero, sets the file-mode permissions on file-backed
// UNIX sockets after binding. It is ignored for TCP/IP addresses and
// abstract namespace sockets.
SocketPerm os.FileMode
}
// NewMultiAddrListener creates listeners for all IP addresses that the hostname
// in the address resolves to. If the address is already an IP, it creates a
// single listener. Returns a MultiListener if multiple addresses are resolved,
@@ -281,7 +290,10 @@ func resolveHostnameAddrs(address string) ([]string, error) {
// - "/path/to/socket" or "./rel/socket" — file-backed socket; any stale
// socket file is removed before binding.
// - "@name" — Linux abstract namespace socket; no file is created or removed.
func NewMultiAddrListener(network, address string) (net.Listener, error) {
//
// opts.SocketPerm, when non-zero, sets the file-mode permissions on file-backed
// sockets after binding. It is ignored for TCP/IP addresses and abstract sockets.
func NewMultiAddrListener(network, address string, opts ListenerOptions) (net.Listener, error) {
if IsUnixSocketPath(address) {
// For file-backed sockets, remove any stale socket file so re-binding works cleanly.
// Abstract sockets (@name) have no filesystem entry; skip removal for them.
@@ -294,6 +306,12 @@ func NewMultiAddrListener(network, address string) (net.Listener, error) {
if err != nil {
return nil, fmt.Errorf("failed to bind unix socket listener %s: %w", address, err)
}
if opts.SocketPerm != 0 && !isAbstractSocket(address) {
if err := os.Chmod(address, opts.SocketPerm); err != nil {
ln.Close()
return nil, fmt.Errorf("failed to set permissions on socket %s: %w", address, err)
}
}
return NewMultiListener(ln), nil
}
@@ -328,7 +346,10 @@ func NewMultiAddrListener(network, address string) (net.Listener, error) {
// - "/path/to/socket" or "./rel/socket" — file-backed socket; any stale
// socket file is removed before binding.
// - "@name" — Linux abstract namespace socket; no file is created or removed.
func NewMultiAddrTLSListener(network, address string, getCertificateFunc func(*tls.ClientHelloInfo) (*tls.Certificate, error)) (net.Listener, error) {
//
// opts.SocketPerm, when non-zero, sets the file-mode permissions on file-backed
// sockets after binding. It is ignored for TCP/IP addresses and abstract sockets.
func NewMultiAddrTLSListener(network, address string, getCertificateFunc func(*tls.ClientHelloInfo) (*tls.Certificate, error), opts ListenerOptions) (net.Listener, error) {
config := &tls.Config{
MinVersion: tls.VersionTLS12,
GetCertificate: getCertificateFunc,
@@ -344,6 +365,12 @@ func NewMultiAddrTLSListener(network, address string, getCertificateFunc func(*t
if err != nil {
return nil, fmt.Errorf("failed to bind unix TLS socket listener %s: %w", address, err)
}
if opts.SocketPerm != 0 && !isAbstractSocket(address) {
if err := os.Chmod(address, opts.SocketPerm); err != nil {
ln.Close()
return nil, fmt.Errorf("failed to set permissions on socket %s: %w", address, err)
}
}
return NewMultiListener(tls.NewListener(ln, config)), nil
}
s3api/utils/multi_listener_test.go
+2 -2
View File
@@ -301,7 +301,7 @@ func TestNewMultiAddrListener(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ln, err := NewMultiAddrListener("tcp", tt.address)
ln, err := NewMultiAddrListener("tcp", tt.address, ListenerOptions{})
if (err != nil) != tt.wantErr {
t.Errorf("NewMultiAddrListener() error = %v, wantErr %v", err, tt.wantErr)
return
@@ -353,7 +353,7 @@ func TestNewMultiAddrTLSListener(t *testing.T) {
return &cert, err
}
ln, err := NewMultiAddrTLSListener("tcp", "127.0.0.1:0", getCertFunc)
ln, err := NewMultiAddrTLSListener("tcp", "127.0.0.1:0", getCertFunc, ListenerOptions{})
if err != nil {
t.Fatalf("NewMultiAddrTLSListener() error = %v", err)
}