Skip to content

Commit b8836d3

Browse files
authored
fix: restrict local listening socket permissions (#318)
1 parent ed6e82a commit b8836d3

File tree

2 files changed

+11
-5
lines changed

2 files changed

+11
-5
lines changed

docs/en/latest/how-it-works.md

+9-4
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,15 @@ Note: If you see some error logs like
6464
phase_func(): failed to connect to the unix socket unix:/tmp/runner.sock: permission denied
6565
```
6666

67-
in the `error.log` of APISIX, you can change the permissions of this file for debug, execute commands like
68-
69-
```shell
70-
chmod 766 /tmp/runner.sock
67+
in the `error.log` of APISIX, ensure the APISIX user is provided rights on the socket. This can be done
68+
for instance by using a common group. Example:
69+
70+
```bash
71+
groupadd apisix_group
72+
usermod -aG apisix_group apisix
73+
usermod -aG apisix_group java_plugin_runner
74+
chown java_plugin_runner:apisix_group /tmp/runner.sock
75+
chmod 760 /tmp/runner.sock
7176
```
7277

7378
To get more detailed debugging information, you can modify the output level of the log.

runner-core/src/main/java/org/apache/apisix/plugin/runner/server/ApplicationRunner.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import org.springframework.beans.factory.annotation.Value;
3333
import org.springframework.boot.CommandLineRunner;
3434
import org.springframework.stereotype.Component;
35+
3536
import com.google.common.cache.Cache;
3637
import io.netty.bootstrap.ServerBootstrap;
3738
import io.netty.channel.ChannelFuture;
@@ -114,7 +115,7 @@ public void start(String path) throws Exception {
114115
try {
115116
initServerBootstrap(bootstrap);
116117
ChannelFuture future = bootstrap.bind(new DomainSocketAddress(path)).sync();
117-
Runtime.getRuntime().exec("chmod 777 " + socketFile);
118+
Runtime.getRuntime().exec("chmod 700 " + socketFile);
118119
logger.warn("java runner is listening on the socket file: {}", socketFile);
119120

120121
future.channel().closeFuture().sync();

0 commit comments

Comments
 (0)