@@ -18,6 +18,8 @@

  *  MA 02110-1301, USA.

  */

+#define _BSD_SOURCE

+

 #if HAVE_CONFIG_H

 #include "clamav-config.h"

 #endif

@@ -165,8 +167,6 @@ int main(int argc, char **argv)

 	return 0;

     }

-    umask(0);

-

     /* drop privileges */

 #ifndef _WIN32

     if(geteuid() == 0 && (opt = optget(opts, "User"))->enabled) {

@@ -464,10 +464,48 @@ int main(int argc, char **argv)

     }

 #ifndef _WIN32

     if(localsock) {

+	mode_t sock_mode, umsk = umask(0777); /* socket is created with 000 to avoid races */

 	if ((lsockets[nlsockets] = localserver(opts)) == -1) {

 	    ret = 1;

+	    umask(umsk);

+	    break;

+	}

+	umask(umsk); /* restore umask */

+	if(optget(opts, "LocalSocketGroup")->enabled) {

+	    char *gname = optget(opts, "LocalSocketGroup")->strarg, *end;

+	    gid_t sock_gid = strtol(gname, &end, 10);

+	    if(*end) {

+		struct group *pgrp = getgrnam(gname);

+		if(!pgrp) {

+		    logg("!Unknown group %s\n", gname);

+		    ret = 1;

+		    break;

+		}

+		sock_gid = pgrp->gr_gid;

+	    }

+	    if(fchown(lsockets[nlsockets], -1, sock_gid)) {

+		logg("!Failed to change socket ownership to group %s\n", gname);

+		ret = 1;

+		break;

+	    }

+	}

+	if(optget(opts, "LocalSocketPerms")->enabled) {

+	    char *end;

+	    sock_mode = strtol(optget(opts, "LocalSocketPerms")->strarg, &end, 8);

+	    if(*end) {

+		logg("!Invalid LocalSocketPerms %s\n", optget(opts, "LocalSocketPerms")->strarg);

+		ret = 1;

+		break;

+	    }

+	} else

+	    sock_mode = 0777 /* & ~umsk*/; /* conservative default: umask was 0 in clamd < 0.96 */

+

+	if(fchmod(lsockets[nlsockets], sock_mode & 0666)) {

+	    logg("!Cannot set socket permission to %s\n", optget(opts, "LocalSocketPerms")->strarg);

+	    ret = 1;

 	    break;

 	}

+

 	nlsockets++;

     }

@@ -184,6 +184,10 @@ const struct clam_option __clam_options[] = {

     { "LocalSocket", NULL, 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_CLAMD, "Path to a local socket file the daemon will listen on.", "/tmp/clamd.socket" },

+    { "LocalSocketGroup", NULL, 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_CLAMD, "Sets the group ownership on the unix socket.", "virusgroup" },

+

+    { "LocalSocketPerms", NULL, 0, TYPE_STRING, NULL, -1, NULL, 0, OPT_CLAMD, "Sets the permissions on the unix socket.", "660" },

+

     { "FixStaleSocket", NULL, 0, TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD | OPT_MILTER, "Remove a stale socket after unclean shutdown", "yes" },

     { "TCPSocket", NULL, 0, TYPE_NUMBER, MATCH_NUMBER, -1, NULL, 0, OPT_CLAMD, "A TCP port number the daemon will listen on.", "3310" },