diff options
| -rw-r--r-- | src/libstore/worker-protocol.hh | 9 | ||||
| -rw-r--r-- | src/nix-worker/nix-worker.cc | 5 |
2 files changed, 10 insertions, 4 deletions
diff --git a/src/libstore/worker-protocol.hh b/src/libstore/worker-protocol.hh index 56d03af55be3..f3b63151dbfb 100644 --- a/src/libstore/worker-protocol.hh +++ b/src/libstore/worker-protocol.hh @@ -38,9 +38,12 @@ typedef enum { #define STDERR_ERROR 0x63787470 -/* The default location of the daemon socket, relative to - nixStateDir. */ -#define DEFAULT_SOCKET_PATH "/daemon.socket" +/* The default location of the daemon socket, relative to nixStateDir. + The socket is in a directory to allow you to control access to the + Nix daemon by setting the mode/ownership of the directory + appropriately. (This wouldn't work on the socket itself since it + must be deleted and recreated on startup.) */ +#define DEFAULT_SOCKET_PATH "/daemon-socket/socket" Path readStorePath(Source & from); diff --git a/src/nix-worker/nix-worker.cc b/src/nix-worker/nix-worker.cc index 6ddf01bd017d..b9d5b1e26309 100644 --- a/src/nix-worker/nix-worker.cc +++ b/src/nix-worker/nix-worker.cc @@ -517,6 +517,8 @@ static void daemonLoop() string socketPath = nixStateDir + DEFAULT_SOCKET_PATH; + createDirs(dirOf(socketPath)); + struct sockaddr_un addr; addr.sun_family = AF_UNIX; if (socketPath.size() >= sizeof(addr.sun_path)) @@ -526,7 +528,8 @@ static void daemonLoop() unlink(socketPath.c_str()); /* Make sure that the socket is created with 0666 permission - (everybody can connect). */ + (everybody can connect --- provided they have access to the + directory containing the socket). */ mode_t oldMode = umask(0111); int res = bind(fdSocket, (struct sockaddr *) &addr, sizeof(addr)); umask(oldMode); |