Create API socket with more sensible permissions

2 files changed, 8 insertions, 0 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3f91b9a9..96c76b75 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,9 @@ Most changes are breaking.
 * The printer TTY is moved from `/tmp/printer` to the more appropriate
   `/run/kutter/printer` (although this feature might be removed entirely in the
   future)
+* The API server socket is now configured with `660` permissions instead of
+  `777 & umask`. This is temporary and will hopefully be configurable in the
+  future.
 
 ### Removed
 
diff --git a/klippy/webhooks.py b/klippy/webhooks.py
index 5902c4ef..661e9117 100644
--- a/klippy/webhooks.py
+++ b/klippy/webhooks.py
@@ -8,6 +8,7 @@ import errno
 import logging
 import os
 import socket
+import stat
 import sys
 
 import gcode
@@ -126,6 +127,10 @@ class ServerSocket:
         self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
         self.sock.setblocking(0)
         self.sock.bind(server_address)
+        # TODO: This is a good compromise for now, but it should be configurable
+        os.chmod(
+            server_address, stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IWGRP
+        )
         self.sock.listen(1)
         self.fd_handle = self.reactor.register_fd(
             self.sock.fileno(), self._handle_accept