harden runtime config and docs

src/linux_fastcgi.cpp

@@ -1353,6 +1353,27 @@ void listen_for_connections()
 	}
 }
 
+mode_t configured_socket_mode(String value, mode_t fallback)
+{
+	value = trim(value);
+	if(value == "")
+		return(fallback);
+	char* end = 0;
+	long parsed = strtol(value.c_str(), &end, 8);
+	if(end == value.c_str() || *end != '\0' || parsed < 0 || parsed > 0777)
+		return(fallback);
+	return((mode_t)parsed);
+}
+
+void chmod_configured_socket(String path, String mode_value, mode_t fallback)
+{
+	if(path == "")
+		return;
+	mode_t mode = configured_socket_mode(mode_value, fallback);
+	if(chmod(path.c_str(), mode) != 0)
+		fprintf(stderr, "(!) Could not chmod socket %s to %04o: %s\n", path.c_str(), (unsigned int)mode, strerror(errno));
+}
+
 void init_base_process()
 {
 	printf("(P) Starting parent server PID:%i\n", getpid());
@@ -1369,13 +1390,13 @@ void init_base_process()
 	if(server_state.config["FCGI_SOCKET_PATH"] != "")
 	{
 		server.listen(server_state.config["FCGI_SOCKET_PATH"]);
-		chmod(server_state.config["FCGI_SOCKET_PATH"].c_str(), S_IRWXU | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
+		chmod_configured_socket(server_state.config["FCGI_SOCKET_PATH"], server_state.config["FCGI_SOCKET_MODE"], 0666);
 	}
 
 	if(server_state.config["CLI_SOCKET_PATH"] != "")
 	{
 		server.listen_cli(server_state.config["CLI_SOCKET_PATH"]);
-		chmod(server_state.config["CLI_SOCKET_PATH"].c_str(), S_IRWXU | S_IRGRP | S_IWGRP);
+		chmod_configured_socket(server_state.config["CLI_SOCKET_PATH"], server_state.config["CLI_SOCKET_MODE"], 0600);
 	}
 
 	// HTTP_PORT (WebSocket + raw HTTP) is owned by the dedicated WS broker, not