src/communication/security-server-comm.c
/* Create a Unix domain socket and bind */
Create a Unix domain socket and bind
Create a Unix domain socket and bind
int create_new_socket(int *sockfd)
{
	int retval = 0, localsockfd = 0, flags;
	struct sockaddr_un serveraddr;
	mode_t sock_mode;
	remove(SECURITY_SERVER_SOCK_PATH);
	if((localsockfd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0 )
	{
		retval = SECURITY_SERVER_ERROR_SOCKET;
		localsockfd = -1;
		SEC_SVR_DBG("%s", "Socket creation failed");
		goto error;
	}
	if((fsetxattr(localsockfd, "security.SMACK64IPOUT", "@", 2, 0)) < 0)
	{
		SEC_SVR_DBG("%s", "SMACK labeling failed");
		if(errno != EOPNOTSUPP)
		{
			retval = SECURITY_SERVER_ERROR_SOCKET;
			localsockfd = -1;
			goto error;
		}
	}
	if((fsetxattr(localsockfd, "security.SMACK64IPIN", "*", 2, 0)) < 0)
	{	SEC_SVR_DBG("%s", "SMACK labeling failed");
		if(errno != EOPNOTSUPP)
		{
			retval = SECURITY_SERVER_ERROR_SOCKET;
			localsockfd = -1;
			goto error;
		}
	}
	if((flags = fcntl(localsockfd, F_GETFL, 0)) < 0 ||
			fcntl(localsockfd, F_SETFL, flags | O_NONBLOCK) < 0)
	{
		retval = SECURITY_SERVER_ERROR_SOCKET;
		close(localsockfd);
		localsockfd = -1;
		SEC_SVR_DBG("%s", "Cannot go to nonblocking mode");
		goto error;
	}
	bzero (&serveraddr, sizeof(serveraddr));
	serveraddr.sun_family = AF_UNIX;
	strncpy(serveraddr.sun_path, SECURITY_SERVER_SOCK_PATH,
			strlen(SECURITY_SERVER_SOCK_PATH));
	serveraddr.sun_path[strlen(SECURITY_SERVER_SOCK_PATH)] = 0;
	if((bind(localsockfd, (struct sockaddr *)&serveraddr, sizeof(serveraddr))) < 0)
	{
		retval = SECURITY_SERVER_ERROR_SOCKET_BIND;
		SEC_SVR_DBG("%s", "Cannot bind");
		close(localsockfd);
		localsockfd = -1;
		goto error;
	}
	sock_mode = (S_IRWXU | S_IRWXG | S_IRWXO);
	if(chmod(SECURITY_SERVER_SOCK_PATH, sock_mode) < 0)		
	{
		SEC_SVR_DBG("%s", "chmod() error");
		retval = SECURITY_SERVER_ERROR_SOCKET;
		close(localsockfd);
		localsockfd = -1;
		goto error;
	}
	retval = SECURITY_SERVER_SUCCESS;
error:
	*sockfd = localsockfd;
	return retval;
}
int create_new_socket ( int * sockfd ) { int retval = 0 , localsockfd = 0 , flags ; struct sockaddr_un serveraddr ; mode_t sock_mode ; remove ( SECURITY_SERVER_SOCK_PATH ) ; if ( ( localsockfd = socket ( AF_UNIX , SOCK_STREAM , 0 ) ) < 0 ) { retval = SECURITY_SERVER_ERROR_SOCKET ; localsockfd = -1 ; SEC_SVR_DBG ( " " , " " ) ; goto error ; } if ( ( fsetxattr ( localsockfd , " " , " " , 2 , 0 ) ) < 0 ) { SEC_SVR_DBG ( " " , " " ) ; if ( errno != EOPNOTSUPP ) { retval = SECURITY_SERVER_ERROR_SOCKET ; localsockfd = -1 ; goto error ; } } if ( ( fsetxattr ( localsockfd , " " , " " , 2 , 0 ) ) < 0 ) { SEC_SVR_DBG ( " " , " " ) ; if ( errno != EOPNOTSUPP ) { retval = SECURITY_SERVER_ERROR_SOCKET ; localsockfd = -1 ; goto error ; } } if ( ( flags = fcntl ( localsockfd , F_GETFL , 0 ) ) < 0 || fcntl ( localsockfd , F_SETFL , flags | O_NONBLOCK ) < 0 ) { retval = SECURITY_SERVER_ERROR_SOCKET ; close ( localsockfd ) ; localsockfd = -1 ; SEC_SVR_DBG ( " " , " " ) ; goto error ; } bzero ( & serveraddr , sizeof ( serveraddr ) ) ; serveraddr . sun_family = AF_UNIX ; strncpy ( serveraddr . sun_path , SECURITY_SERVER_SOCK_PATH , strlen ( SECURITY_SERVER_SOCK_PATH ) ) ; serveraddr . sun_path [ strlen ( SECURITY_SERVER_SOCK_PATH ) ] = 0 ; if ( ( bind ( localsockfd , ( struct sockaddr * ) & serveraddr , sizeof ( serveraddr ) ) ) < 0 ) { retval = SECURITY_SERVER_ERROR_SOCKET_BIND ; SEC_SVR_DBG ( " " , " " ) ; close ( localsockfd ) ; localsockfd = -1 ; goto error ; } sock_mode = ( S_IRWXU | S_IRWXG | S_IRWXO ) ; if ( chmod ( SECURITY_SERVER_SOCK_PATH , sock_mode ) < 0 ) { SEC_SVR_DBG ( " " , " " ) ; retval = SECURITY_SERVER_ERROR_SOCKET ; close ( localsockfd ) ; localsockfd = -1 ; goto error ; } retval = SECURITY_SERVER_SUCCESS ; error : * sockfd = localsockfd ; return retval ; }
Create a Unix domain socket and bind
Create a Unix domain socket and bind
/* Deleted garbage Unix domain socket file */ /* Create Unix domain socket */ /* Make socket as non blocking */ /* Bind the socket */ /* Change permission to accept all processes that has different uID/gID */ /* Flawfinder hits this chmod function as level 5 CRITICAL as race condition flaw *
	 * Flawfinder recommends to user fchmod insted of chmod
	 * But, fchmod doesn't work on socket file so there is no other choice at this point */ /* Flawfinder: ignore */