NSM_LISTEN_ON unix socket file permissions

[zolug]

This item is related to using nsm from an nsc app running as non-root.

Currently the unix listenOn socket gets created with file permissions that do not grant write access for others:

Defaulted container "nsmgr" out of: nsmgr, exclude-prefixes
/ # ls -l /var/lib/networkservicemesh/nsm.io.sock
srwxr-xr-x    1 root     root             0 Jun 28 15:01 /var/lib/networkservicemesh/nsm.io.sock

Since the socket gets created in a hostPath volume, nsm users mounting it can't rely for example on fsGroup to change group ownership. To workaround this, either an init container could be applied changing file permission/ownership, or CAP_DAC_OVERRIDE capability could be utilized by the nsc binary to bypass permission checks.

A more user friendly approach could be setting os.ModePerm file permissions in nsmgr when the socket is created, as it would not put additional requirements on the nsc application (to run as non-root).
This behaviour would match how Spire handles their unix listener:
https://github.com/spiffe/spire/blob/07219c7aed188820ebe5ffb67125fdbf69d00286/pkg/agent/endpoints/endpoints_posix.go#L31

What do you think?

nsmgr:

cmd-nsmgr/internal/manager/manager.go

Line 205 in 90a32f8

errChan := grpcutils.ListenAndServe(m.ctx, listenURL, server)

https://github.com/networkservicemesh/sdk/blob/main/pkg/tools/grpcutils/listen_and_serve.go#L66

[denis-tingaikin]

/сс @edwarnicke, @fkautz

[denis-tingaikin]

I think that is a good suggestion and can be done in v1.5.0.

@edwarnicke, @fkautz Do you have any thoughts on that?

[edwarnicke]

I think the os.ModePerm is the right solution here.

[denis-tingaikin]

Should be resovled with networkservicemesh/sdk#1320

@zolug Feel free to reopen if we missed something.