warden/rlgwebd
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix possibly insecure permissions on the control socket.

Browse source 
The server's control socket is now in a private directory.
This commit is contained in:
John "Elwin" Edwards 2017-01-28 09:57:31 -05:00
parent c4d10ba33d
commit 4059bf2983
4 changed files with 19 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
initscript
View file

@ -2,7 +2,7 @@
NODE_PATH=/usr/lib/node_modules NODE_PATH=/usr/lib/node_modules
LOGFILE=/var/log/rlgwebd.log LOGFILE=/var/log/rlgwebd.log
CTLSOCKET=/var/run/rlgwebd.sock CTLSOCKET=/var/run/rlgwebd/rlgwebd.sock
RLGWEBDJS=/usr/local/bin/rlgwebd RLGWEBDJS=/usr/local/bin/rlgwebd
export NODE_PATH export NODE_PATH

17
rlgwebd
View file

@ -15,7 +15,7 @@ var WebSocketServer = require("websocket").server;
/* Default options */ /* Default options */
var rlgwebd_options = { var rlgwebd_options = {
control_socket: "/var/run/rlgwebd.sock", control_socket: "/var/run/rlgwebd/rlgwebd.sock",
port: 8080, port: 8080,
chrootDir: "/var/dgl/", chrootDir: "/var/dgl/",
username: "rodney", username: "rodney",
@ -1266,6 +1266,21 @@ if (rlgwebd_options.use_https) {
tls_options.ca = read_or_die(rlgwebd_options.cafile, "CA file"); tls_options.ca = read_or_die(rlgwebd_options.cafile, "CA file");
}; };
/* Make sure the socket directory is secure. */
var socket_dir = path.dirname(rlgwebd_options.control_socket);
try {
fs.mkdirSync(socket_dir, 0o700);
}
catch (err) {
if (err.code == "EEXIST") {
fs.chownSync(socket_dir, 0, 0);
fs.chmodSync(socket_dir, 0o700);
}
else {
throw err;
}
}
/* Open the control socket before chrooting where it can't be found */ /* Open the control socket before chrooting where it can't be found */
var ctlServer = net.createServer(function (sock) { var ctlServer = net.createServer(function (sock) {
sock.on('data', consoleHandler); sock.on('data', consoleHandler);

2
rlgwebd-stop
View file

@ -1,7 +1,7 @@
#!/usr/bin/env node #!/usr/bin/env node
var net = require('net'); var net = require('net');
var sockpath = "/var/run/rlgwebd.sock"; var sockpath = "/var/run/rlgwebd/rlgwebd.sock";
var sock = new net.Socket(); var sock = new net.Socket();

2
rlgwebd.conf
View file

@ -3,7 +3,7 @@
# These values are set by default: # These values are set by default:
# Location of the socket for start/stop commands # Location of the socket for start/stop commands
#control_socket = /var/run/rlgwebd.sock #control_socket = /var/run/rlgwebd/rlgwebd.sock
# Port number to bind # Port number to bind
#port = 8080 #port = 8080
# Path to the dgamelaunch installation to chroot into # Path to the dgamelaunch installation to chroot into