Change socket properties after creation

[oej]

diff --git a/pkg/runner/runner.go b/pkg/runner/runner.go
index 17cb068..d8981d7 100644
--- a/pkg/runner/runner.go
+++ b/pkg/runner/runner.go
@@ -1220,6 +1220,10 @@ func Run(logger *slog.Logger, loggerLevel *slog.LevelVar) {
                        logger.Error("unable to create dnstap unix socket", "error", err)
                        os.Exit(1)
                }
+               err = os.Chmod(startConf.InputUnix, 0775)
+               if err != nil {
+                       logger.Error("unable to chmod dnstap unix socket", "error", err)
+               }
        } else if startConf.InputTCP != "" {
                logger.Info("creating plaintext dnstap TCP socket", "socket", startConf.InputTCP)
                l, err := net.Listen("tcp", startConf.InputTCP)

Could possibly be a config option. This was needed for one of our partners to run EDM on their servers without changing owner/user of the resolver process.

[morkrost]

My suggestion is to use 0660 permissions with the socket owned by EDM as user and "named", " dnsservices", or similar as the group owner. Adding the name server application to that group should work. Let's test that.

[oej]

So we need to be able to config the user and group for the socket in addition to the permissions?

[morkrost]

EDM doesn't ever need to run as root, so it doesn't have (or shouldn't need) the ability to set a different uid. If the group used is the primary group of the edm user, it also shouldn't need to change the gid.

The resolvers all start as root to bind the privileged ports it uses, but then drops privileges to the uid:gid that's in their config. If this gid is the primary group of EDM, it "should just work" with the 0660 permissions. In fact, if the uid of the name server is member of the group that EDM uses, it again "should just work".

The "should just work" denominator sometimes is surprisingly brittle though, so here are a few cases we do need to test (and SE Linux is at the top of the list). Currently I can't see any reason to make any of this configurable, and if we want stronger separation mechanisms, having EDM control them defeats the purpose. If the socket isn't 0660 already, we should fix that. Default might be 0600.

[linkdata]

EDM binary shouldn't care what user/group it is being run as (except possibly complain if it's root), but the port permissions should probably be configurable with a sane default (0660 sounds good to me).