Ensure grpc socket is group writable

Updates the filemode on the grpc socket to have group write
permission which is needed to perform GRPC. Additionally, ensure
the run directory has the specified group ownership and has group
read and enter permission.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>

cmd/containerd/main_unix.go

@@ -35,6 +35,12 @@ func platformInit(context *cli.Context) error {
 			return err
 		}
 	}
+	if err := os.MkdirAll(conf.State, 0750); err != nil {
+		return err
+	}
+	if err := os.Chown(conf.State, conf.GRPC.Uid, conf.GRPC.Gid); err != nil {
+		return err
+	}
 	return nil
 }
 

sys/socket_unix.go

@@ -28,6 +28,11 @@ func GetLocalListener(path string, uid, gid int) (net.Listener, error) {
 		return l, err
 	}
 
+	if err := os.Chmod(path, 0660); err != nil {
+		l.Close()
+		return nil, err
+	}
+
 	if err := os.Chown(path, uid, gid); err != nil {
 		l.Close()
 		return nil, err