net: allow IPC servers be accessible by all

Adds mappings to uv_pipe_chmod call by adding two new options to
listen call. This allows the IPC server pipe to be made readable or
writable by all users.
Fixes: #19154
PR-URL: #19472
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Author: bzoz

doc/api/net.md

@@ -260,6 +260,10 @@ added: v0.11.14
 *`backlog` {number} Common parameter of [`server.listen()`][]
  functions.
 *`exclusive` {boolean} **Default:**`false`
+*`readableAll` {boolean} For IPC servers makes the pipe readable
+ for all users. **Default:**`false`
+*`writableAll` {boolean} For IPC servers makes the pipe writable
+ for all users. **Default:**`false`
 *`callback` {Function} Common parameter of [`server.listen()`][]
  functions.
 * Returns: {net.Server}
@@ -285,6 +289,10 @@ server.listen({
 });
 ```
 
+Starting an IPC server as root may cause the server path to be inaccessible for
+unprivileged users. Using `readableAll` and `writableAll` will make the server
+accessible for all users.
+
 #### server.listen(path[, backlog][, callback])
 <!-- YAML
 added: v0.1.90

lib/net.js

@@ -1475,6 +1475,19 @@ Server.prototype.listen = function(...args) {
 backlog=options.backlog||backlogFromArgs;
 listenInCluster(this,pipeName,-1,-1,
 backlog,undefined,options.exclusive);
+letmode=0;
+if(options.readableAll===true)
+mode|=PipeConstants.UV_READABLE;
+if(options.writableAll===true)
+mode|=PipeConstants.UV_WRITABLE;
+if(mode!==0){
+consterr=this._handle.fchmod(mode);
+if(err){
+this._handle.close();
+this._handle=null;
+throwerrnoException(err,'uv_pipe_chmod');
+}
+}
 returnthis;
 }
 

src/pipe_wrap.cc

@@ -98,6 +98,8 @@ void PipeWrap::Initialize(Local<Object> target,
  env->SetProtoMethod(t, "setPendingInstances", SetPendingInstances);
 #endif
 
+ env->SetProtoMethod(t, "fchmod", Fchmod);
+
  target->Set(pipeString, t->GetFunction());
  env->set_pipe_constructor_template(t);
 
@@ -114,6 +116,8 @@ void PipeWrap::Initialize(Local<Object> target,
 NODE_DEFINE_CONSTANT(constants, SOCKET);
 NODE_DEFINE_CONSTANT(constants, SERVER);
 NODE_DEFINE_CONSTANT(constants, IPC);
+NODE_DEFINE_CONSTANT(constants, UV_READABLE);
+NODE_DEFINE_CONSTANT(constants, UV_WRITABLE);
  target->Set(context,
 FIXED_ONE_BYTE_STRING(env->isolate(), "constants"),
  constants).FromJust();
@@ -184,6 +188,17 @@ void PipeWrap::SetPendingInstances(const FunctionCallbackInfo<Value>& args) {
 #endif
 
 
+voidPipeWrap::Fchmod(const v8::FunctionCallbackInfo<v8::Value>& args) {
+ PipeWrap* wrap;
+ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());
+CHECK(args[0]->IsInt32());
+int mode = args[0].As<Int32>()->Value();
+int err = uv_pipe_chmod(reinterpret_cast<uv_pipe_t*>(&wrap->handle_),
+ mode);
+ args.GetReturnValue().Set(err);
+}
+
+
 voidPipeWrap::Listen(const FunctionCallbackInfo<Value>& args) {
  PipeWrap* wrap;
 ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());

src/pipe_wrap.h

@@ -63,6 +63,7 @@ class PipeWrap : public ConnectionWrap<PipeWrap, uv_pipe_t> {
 staticvoidSetPendingInstances(
 const v8::FunctionCallbackInfo<v8::Value>& args);
 #endif
+staticvoidFchmod(const v8::FunctionCallbackInfo<v8::Value>& args);
 };
 
 

test/parallel/test-net-server-listen-path.js

@@ -2,6 +2,8 @@
 
 constcommon=require('../common');
 constnet=require('net');
+constassert=require('assert');
+constfs=require('fs');
 
 consttmpdir=require('../common/tmpdir');
 tmpdir.refresh();
@@ -48,3 +50,22 @@ function randomPipePath() {
 net.createServer()
 .listen({path: handlePath},closeServer());
 }
+
+// Test pipe chmod
+{
+consthandlePath=randomPipePath();
+
+constsrv=net.createServer()
+.listen({
+path: handlePath,
+readableAll: true,
+writableAll: true
+},common.mustCall(()=>{
+if(process.platform!=='win32'){
+constmode=fs.statSync(handlePath).mode;
+assert.ok(mode&fs.constants.S_IROTH!==0);
+assert.ok(mode&fs.constants.S_IWOTH!==0);
+}
+srv.close();
+}));
+}