<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">--- kdm/ConfigureChecks.cmake
+++ kdm/ConfigureChecks.cmake
@@ -37,6 +37,35 @@ int main()
 }
 " HAVE_SETLOGIN)
 
+check_c_source_runs("
+#include &lt;sys/socket.h&gt;
+#include &lt;sys/un.h&gt;
+#include &lt;sys/stat.h&gt;
+#include &lt;sys/types.h&gt;
+#include &lt;string.h&gt;
+#include &lt;unistd.h&gt;
+#include &lt;errno.h&gt;
+int main()
+{
+    int fd, fd2;
+    struct sockaddr_un sa;
+
+    if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) &lt; 0)
+        return 2;
+    sa.sun_family = AF_UNIX;
+    strcpy(sa.sun_path, \"testsock\");
+    unlink(sa.sun_path);
+    if (bind(fd, (struct sockaddr *)&amp;sa, sizeof(sa)))
+        return 2;
+    chmod(sa.sun_path, 0);
+    setuid(getuid() + 1000);
+    if ((fd2 = socket(PF_UNIX, SOCK_STREAM, 0)) &lt; 0)
+        return 2;
+    connect(fd2, (struct sockaddr *)&amp;sa, sizeof(sa));
+    return errno != EACCES;
+}
+" HONORS_SOCKET_PERMS)
+
 # for config-kdm.h
 check_function_exists(seteuid HAVE_SETEUID)
 
--- kdm/backend/ctrl.c
+++ kdm/backend/ctrl.c
@@ -79,7 +79,25 @@ nukeSock( struct cmdsock *cs )
 }
 
 
+#ifdef HONORS_SOCKET_PERMS
 static CtrlRec ctrl = { 0, 0, -1, 0 };
+#else
+static CtrlRec ctrl = { 0, 0, 0, -1, 0 };
+
+static int mkTempDir( char *dir )
+{
+	int i, l = strlen( dir ) - 6;
+
+	for (i = 0; i &lt; 100; i++) {
+		randomStr( dir + l );
+		if (!mkdir( dir, 0700 ))
+			return True;
+		if (errno != EEXIST)
+			break;
+	}
+	return False;
+}
+#endif
 
 void
 openCtrl( struct display *d )
@@ -113,22 +131,50 @@ openCtrl( struct display *d )
 				if (strlen( cr-&gt;path ) &gt;= sizeof(sa.sun_path))
 					logError( "path %\"s too long; control socket will not be available\n",
 					          cr-&gt;path );
-				else if (mkdir( sockdir, 0755 ) &amp;&amp; errno != EEXIST)
+#ifdef HONORS_SOCKET_PERMS
+				else if (mkdir( sockdir, 0700 ) &amp;&amp; errno != EEXIST)
 					logError( "mkdir %\"s failed: %m; control socket will not be available\n",
 					          sockdir );
+				else if (unlink( cr-&gt;path ) &amp;&amp; errno != ENOENT)
+					logError( "unlink %\"s failed: %m; control socket will not be available\n",
+					          cr-&gt;path );
 				else {
-					if (!d)
-						chown( sockdir, -1, fifoGroup );
+#else
+				else if (unlink( sockdir ) &amp;&amp; errno != ENOENT)
+					logError( "unlink %\"s failed: %m; control socket will not be available\n",
+					          sockdir );
+				else if (!strApp( &amp;cr-&gt;realdir, sockdir, "-XXXXXX", (char *)0))
+					;
+				else if (!mkTempDir( cr-&gt;realdir )) {
+					logError( "mkdir %\"s failed: %m; control socket will not be available\n",
+					          cr-&gt;realdir );
+					free( cr-&gt;realdir );
+					cr-&gt;realdir = 0;
+				} else if (symlink( cr-&gt;realdir, sockdir )) {
+					logError( "symlink %\"s =&gt; %\"s failed: %m; control socket will not be available\n",
+					          sockdir, cr-&gt;realdir );
+					rmdir( cr-&gt;realdir );
+					free( cr-&gt;realdir );
+					cr-&gt;realdir = 0;
+				} else {
+					chown( sockdir, 0, d ? 0 : fifoGroup );
 					chmod( sockdir, 0750 );
+#endif
 					if ((cr-&gt;fd = socket( PF_UNIX, SOCK_STREAM, 0 )) &lt; 0)
 						logError( "Cannot create control socket: %m\n" );
 					else {
-						unlink( cr-&gt;path );
 						sa.sun_family = AF_UNIX;
 						strcpy( sa.sun_path, cr-&gt;path );
 						if (!bind( cr-&gt;fd, (struct sockaddr *)&amp;sa, sizeof(sa) )) {
 							if (!listen( cr-&gt;fd, 5 )) {
+#ifdef HONORS_SOCKET_PERMS
+								chmod( cr-&gt;path, 0660 );
+								if (!d)
+									chown( cr-&gt;path, -1, fifoGroup );
+								chmod( sockdir, 0755 );
+#else
 								chmod( cr-&gt;path, 0666 );
+#endif
 								registerCloseOnFork( cr-&gt;fd );
 								registerInput( cr-&gt;fd );
 								free( sockdir );
@@ -143,6 +189,14 @@ openCtrl( struct display *d )
 						close( cr-&gt;fd );
 						cr-&gt;fd = -1;
 					}
+#ifdef HONORS_SOCKET_PERMS
+					rmdir( sockdir );
+#else
+					unlink( sockdir );
+					rmdir( cr-&gt;realdir );
+					free( cr-&gt;realdir );
+					cr-&gt;realdir = 0;
+#endif
 				}
 				free( cr-&gt;path );
 				cr-&gt;path = 0;
@@ -163,7 +217,14 @@ closeCtrl( struct display *d )
 		cr-&gt;fd = -1;
 		unlink( cr-&gt;path );
 		*strrchr( cr-&gt;path, '/' ) = 0;
+#ifdef HONORS_SOCKET_PERMS
 		rmdir( cr-&gt;path );
+#else
+		unlink( cr-&gt;path );
+		rmdir( cr-&gt;realdir );
+		free( cr-&gt;realdir );
+		cr-&gt;realdir = 0;
+#endif
 		free( cr-&gt;path );
 		cr-&gt;path = 0;
 		while (cr-&gt;css) {
@@ -177,12 +238,12 @@ closeCtrl( struct display *d )
 void
 chownCtrl( CtrlRec *cr, int uid )
 {
-	if (cr-&gt;path) {
-		char *ptr = strrchr( cr-&gt;path, '/' );
-		*ptr = 0;
+	if (cr-&gt;path)
+#ifdef HONORS_SOCKET_PERMS
 		chown( cr-&gt;path, uid, -1 );
-		*ptr = '/';
-	}
+#else
+		chown( cr-&gt;realdir, uid, -1 );
+#endif
 }
 
 void
--- kdm/backend/dm.h
+++ kdm/backend/dm.h
@@ -232,6 +232,9 @@ typedef struct {
 	struct cmdsock *css;  /* open connections */
 
 	char *path;           /* filename of the socket */
+#ifndef HONORS_SOCKET_PERMS
+	char *realdir;        /* real dirname of the socket */
+#endif
 	int fd;               /* fd of the socket */
 	int gid;              /* owner group of the socket */
 } CtrlRec;
--- kdm/config-kdm.h.cmake
+++ kdm/config-kdm.h.cmake
@@ -129,6 +129,9 @@
 /* Define to 1 if the ck-connector library is found */
 #cmakedefine HAVE_CKCONNECTOR 1
 
+/* Define to 1 if OS honors permission bits on socket inodes */
+#cmakedefine HONORS_SOCKET_PERMS 1
+
 /* $PATH defaults set by KDM */
 #cmakedefine KDM_DEF_USER_PATH "${KDM_DEF_USER_PATH}"
 #cmakedefine KDM_DEF_SYSTEM_PATH "${KDM_DEF_SYSTEM_PATH}"
-- 
1.6.6.20.g9bfff

</pre></body></html>