From 7dd03b46ee8d134eb60c773700c3a558e757cd9a Mon Sep 17 00:00:00 2001
From: Andreas Kling <awesomekling@gmail.com>
Date: Thu, 9 Jan 2020 21:35:33 +0100
Subject: [PATCH] SystemServer: Allow specifying per-service socket file
 permissions

---
 Base/usr/share/man/man5/SystemServer.md | 1 +
 Servers/SystemServer/Service.cpp        | 4 +++-
 Servers/SystemServer/Service.h          | 2 ++
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/Base/usr/share/man/man5/SystemServer.md b/Base/usr/share/man/man5/SystemServer.md
index 9e00d07af50..024ce1bdc1c 100644
--- a/Base/usr/share/man/man5/SystemServer.md
+++ b/Base/usr/share/man/man5/SystemServer.md
@@ -23,6 +23,7 @@ describing how to launch and manage this service.
 * `KeepAlive` - whether the service should be restarted if it exits or crashes. For lazy services, this means the service will get respawned once a new connection is attempted on their socket after they exit or crash.
 * `Lazy` - whether the service should only get spawned once a client attempts to connect to their socket.
 * `Socket` - a path to a socket to create on behalf of the service. For lazy services, SystemServer will actually watch the socket for new connection attempts. An open file descriptor to this socket will be passed as fd 3 to the service.
+* `SocketPermissions` - (octal) file system permissions for the socket file. The default permissions are 0600.
 * `User` - a name of the user to run the service as. This impacts what UID, GID (and extra GIDs) the service processes have. By default, services are run as root.
 
 ## Environment
diff --git a/Servers/SystemServer/Service.cpp b/Servers/SystemServer/Service.cpp
index 4191b8d4c2b..d97a05e3d16 100644
--- a/Servers/SystemServer/Service.cpp
+++ b/Servers/SystemServer/Service.cpp
@@ -104,7 +104,7 @@ void Service::setup_socket()
         ASSERT_NOT_REACHED();
     }
 
-    if (fchmod(m_socket_fd, 0600) < 0) {
+    if (fchmod(m_socket_fd, m_socket_permissions) < 0) {
         perror("fchmod");
         ASSERT_NOT_REACHED();
     }
@@ -270,6 +270,8 @@ Service::Service(const CConfigFile& config, const StringView& name)
 
     m_socket_path = config.read_entry(name, "Socket");
     if (!m_socket_path.is_null()) {
+        auto socket_permissions_string = config.read_entry(name, "SocketPermissions", "0600");
+        m_socket_permissions = strtol(socket_permissions_string.characters(), nullptr, 8) & 04777;
         setup_socket();
     }
 }
diff --git a/Servers/SystemServer/Service.h b/Servers/SystemServer/Service.h
index 7abb0444e02..3c56a9e08a2 100644
--- a/Servers/SystemServer/Service.h
+++ b/Servers/SystemServer/Service.h
@@ -38,6 +38,8 @@ private:
     bool m_keep_alive { false };
     // Path to the socket to create and listen on on behalf of this service.
     String m_socket_path;
+    // File system permissions for the socket.
+    mode_t m_socket_permissions { 0 };
     // Whether we should only spawn this service once somebody connects to the socket.
     bool m_lazy;
     // The name of the user we should run this service as.