From 3f0c7161989b2adbbb00ce26838097e26ed6c09a Mon Sep 17 00:00:00 2001
From: Martin Schwenke <mschwenke@ddn.com>
Date: Thu, 11 Jun 2026 11:25:52 +1000
Subject: [PATCH 15/23] CVE-2026-58224: ctdb-common: Secure sock_daemon Unix domain sockets

Currently, the mode of the socket depends on the creating process's
umask.  This might allow unwanted access.

It might be preferable to do this just for the eventd socket.
However, there is no useful place to hook this in outside of
sock_daemon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 ctdb/common/sock_daemon.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/ctdb/common/sock_daemon.c b/ctdb/common/sock_daemon.c
index e31a36445b5..ed0ccfd70ef 100644
--- a/ctdb/common/sock_daemon.c
+++ b/ctdb/common/sock_daemon.c
@@ -204,6 +204,8 @@ static int sock_client_context_destructor(
 static int socket_setup(const char *sockpath, bool remove_before_use)
 {
 	struct sockaddr_un addr;
+	const char *t;
+	bool test_mode_enabled = false;
 	size_t len;
 	int ret, fd;
 
@@ -240,6 +242,30 @@ static int socket_setup(const char *sockpath, bool remove_before_use)
 		return -1;
 	}
 
+	t = getenv("CTDB_TEST_MODE");
+	if (t != NULL) {
+		test_mode_enabled = true;
+	}
+
+	if (!test_mode_enabled) {
+		/* Behaviour of fchown(2) is undefined on sockets */
+		ret = chown(sockpath, geteuid(), getegid());
+		if (ret != 0) {
+			D_ERR("Unable to secure (chown) socket '%s'\n",
+			      sockpath);
+			close(fd);
+			return -1;
+		}
+	}
+
+	/* Behaviour of fchmod(2) is undefined on sockets */
+	ret = chmod(sockpath, 0700);
+	if (ret != 0) {
+		D_ERR("Unable to secure (chmod) socket '%s'\n", sockpath);
+		close(fd);
+		return -1;
+	}
+
 	ret = listen(fd, 10);
 	if (ret != 0) {
 		D_ERR("socket listen failed - %s\n", sockpath);
-- 
2.43.0


