From 72c32f2902886bf205ae7ea412909c41dda1a95e Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Sun, 5 Apr 2009 19:15:53 -0700 Subject: Enforce umask 0000 with UNIX domain sockets I can't think of a good reason to ever use restrictive permissions with UNIX domain sockets for an HTTP server. Since some folks run their nginx on port 80 and then have it drop permissions, we need to ensure our socket is readable and writable across the board. The reason I'm respecting the existing umask at all (instead of using 0000 across the board like most daemonizers) is because the admin may want to restrict access (especially write access) to log files. --- lib/unicorn/socket.rb | 3 +++ 1 file changed, 3 insertions(+) (limited to 'lib') diff --git a/lib/unicorn/socket.rb b/lib/unicorn/socket.rb index 0dba8cb..1b666b4 100644 --- a/lib/unicorn/socket.rb +++ b/lib/unicorn/socket.rb @@ -91,11 +91,14 @@ module Unicorn sock = Socket.new(domain, SOCK_STREAM, 0) sock.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) if defined?(SO_REUSEADDR) + old_umask = File.umask(0) begin sock.bind(bind_addr) rescue Errno::EADDRINUSE sock.close rescue nil return nil + ensure + File.umask(old_umask) end if opt[:rcvbuf] || opt[:sndbuf] log_buffer_sizes(sock, "before: ") -- cgit v1.2.3-24-ge0c7