| 256 | "\n" |
| 257 | " chmod 0700 %s"); |
| 258 | static void init_socket_directory(const char *path) |
| 259 | { |
| 260 | struct stat st; |
| 261 | char *path_copy = xstrdup(path); |
| 262 | char *dir = dirname(path_copy); |
| 263 | |
| 264 | if (!stat(dir, &st)) { |
| 265 | if (st.st_mode & 077) |
| 266 | die(_(permissions_advice), dir); |
| 267 | } else { |
| 268 | /* |
| 269 | * We must be sure to create the directory with the correct mode, |
| 270 | * not just chmod it after the fact; otherwise, there is a race |
| 271 | * condition in which somebody can chdir to it, sleep, then try to open |
| 272 | * our protected socket. |
| 273 | */ |
| 274 | if (safe_create_leading_directories_const(the_repository, dir) < 0) |
| 275 | die_errno("unable to create directories for '%s'", dir); |
| 276 | if (mkdir(dir, 0700) < 0) |
| 277 | die_errno("unable to mkdir '%s'", dir); |
| 278 | } |
| 279 | |
| 280 | if (chdir(dir)) |
| 281 | /* |
| 282 | * We don't actually care what our cwd is; we chdir here just to |
| 283 | * be a friendly daemon and avoid tying up our original cwd. |
| 284 | * If this fails, it's OK to just continue without that benefit. |
| 285 | */ |
| 286 | ; |
| 287 | |
| 288 | free(path_copy); |
| 289 | } |
| 290 | |
| 291 | int cmd_credential_cache_daemon(int argc, |
| 292 | const char **argv, |
no test coverage detected