SystemServer: Allow specifying per-service socket file permissions

Base/usr/share/man/man5/SystemServer.md

@@ -23,6 +23,7 @@ describing how to launch and manage this service.
 * `KeepAlive` - whether the service should be restarted if it exits or crashes. For lazy services, this means the service will get respawned once a new connection is attempted on their socket after they exit or crash.
 * `Lazy` - whether the service should only get spawned once a client attempts to connect to their socket.
 * `Socket` - a path to a socket to create on behalf of the service. For lazy services, SystemServer will actually watch the socket for new connection attempts. An open file descriptor to this socket will be passed as fd 3 to the service.
+* `SocketPermissions` - (octal) file system permissions for the socket file. The default permissions are 0600.
 * `User` - a name of the user to run the service as. This impacts what UID, GID (and extra GIDs) the service processes have. By default, services are run as root.
 
 ## Environment

Servers/SystemServer/Service.cpp

@@ -104,7 +104,7 @@ void Service::setup_socket()
  ASSERT_NOT_REACHED();
  }
 
- if (fchmod(m_socket_fd, 0600) < 0) {
+ if (fchmod(m_socket_fd, m_socket_permissions) < 0) {
  perror("fchmod");
  ASSERT_NOT_REACHED();
  }
@@ -270,6 +270,8 @@ Service::Service(const CConfigFile& config, const StringView& name)
 
  m_socket_path = config.read_entry(name, "Socket");
  if (!m_socket_path.is_null()) {
+ auto socket_permissions_string = config.read_entry(name, "SocketPermissions", "0600");
+ m_socket_permissions = strtol(socket_permissions_string.characters(), nullptr, 8) & 04777;
  setup_socket();
  }
 }

Servers/SystemServer/Service.h

@@ -38,6 +38,8 @@ class Service final : public CObject {
  bool m_keep_alive { false };
  // Path to the socket to create and listen on on behalf of this service.
  String m_socket_path;
+ // File system permissions for the socket.
+ mode_t m_socket_permissions { 0 };
  // Whether we should only spawn this service once somebody connects to the socket.
  bool m_lazy;
  // The name of the user we should run this service as.