On Sun, Nov 27, 2022 at 7:39 PM Nir Soffer <nsoffer@redhat.com> wrote:
We bind the socket after dropping privileges so the socket is already
owned by the current user and group and there is no need to change
ownership.

This works when running in unprivileged mode locally but fails on Ubuntu
CI:

    Using non-standard run directory '/tmp/sanlock'
    Running in unprivileged mode uid=1001 gid=1001
    sanlock daemon started 3.8.5 host 64b4f365-e153-4e0f-b4bf-c462c37739e7.fv-az41-301 (fv-az41-301)
    could not set socket /tmp/sanlock/sanlock.sock permissions: Operation not permitted

Signed-off-by: Nir Soffer <nsoffer@redhat.com>
---
 src/main.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/src/main.c b/src/main.c
index f0182b6..3944452 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1385,27 +1385,20 @@ static int setup_listener(void)

        unlink(addr.sun_path);
        rv = bind(fd, (struct sockaddr *) &addr, sizeof(struct sockaddr_un));
        if (rv < 0)
                goto exit_fail;

        rv = chmod(addr.sun_path, DEFAULT_SOCKET_MODE);
        if (rv < 0)
                goto exit_fail;

-       rv = chown(addr.sun_path, com.uid, com.gid);
-       if (rv < 0) {
-               log_error("could not set socket %s permissions: %s",
-                       addr.sun_path, strerror(errno));
-               goto exit_fail;
-       }

This was added in

commit d8805d428ff7c8994a43cc5265eb5379f4db1057
Author: Federico Simoncelli <fsimonce@redhat.com>
Date:   Wed Apr 20 13:59:33 2011 +0100

    daemon: configurable socket permissions

When it was added sanlock did not dropped privileges.

We started to drop privileges in:

commit 5c51530b5bccb8cfadc8a8591558b9ab99b95cb3
Author: Federico Simoncelli <fsimonce@redhat.com>
Date:   Wed Jul 18 12:44:15 2012 -0500

    daemon: drop root privileges and use the helper
 
Since that commit, chown() is called from the user running sanlock, trying to change
the ownership to the same uid/gid.


-
        rv = listen(fd, 5);
        if (rv < 0)
                goto exit_fail;

        fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);

        ci = client_add(fd, process_listener, NULL);
        if (ci < 0)
                goto exit_fail;

--
2.38.1