add config option server-unix-socket-mode (#1415)

* added config option server-unix-socket-mode to enable custom socket permissions

* added server-unix-socket-mode input validation

src/PostgREST/Config.hs

@@ -46,8 +46,10 @@ import Data.Text.IO                (hPutStrLn)
 import Data.Version                (versionBranch)
 import Development.GitRev          (gitHash)
 import Network.Wai.Middleware.Cors (CorsResourcePolicy (..))
+import Numeric                     (readOct)
 import Paths_postgrest             (version)
 import System.IO.Error             (IOError)
+import System.Posix.Types          (FileMode)
 
 import Control.Applicative
 import Data.Monoid
@@ -63,6 +65,7 @@ import Protolude         hiding (concat, hPutStrLn, intercalate, null,
                           take, (<>))
 
 
+
 -- | Config file settings for the server
 data AppConfig = AppConfig {
     configDatabase          :: Text
@@ -72,6 +75,7 @@ data AppConfig = AppConfig {
   , configHost              :: Text
   , configPort              :: Int
   , configSocket            :: Maybe Text
+  , configSocketMode        :: Either Text FileMode
 
   , configJwtSecret         :: Maybe B.ByteString
   , configJwtSecretIsBase64 :: Bool
@@ -155,6 +159,7 @@ readOptions = do
         <*> (fromMaybe "!4" <$> optString "server-host")
         <*> (fromMaybe 3000 <$> optInt "server-port")
         <*> optString "server-unix-socket"
+        <*> parseSocketFileMode "server-unix-socket-mode"
         <*> (fmap encodeUtf8 <$> optString "jwt-secret")
         <*> (fromMaybe False <$> optBool "secret-is-base64")
         <*> parseJwtAudience "jwt-aud"
@@ -169,6 +174,19 @@ readOptions = do
         <*> optString "root-spec"
         <*> (maybe [] (fmap encodeUtf8 . splitOnCommas) <$> optValue "raw-media-types")
 
+    parseSocketFileMode :: C.Key -> C.Parser C.Config (Either Text FileMode)
+    parseSocketFileMode k =
+      C.optional k C.string >>= \case
+        Nothing -> pure $ Right 493 -- return default 755 mode if no value was provided
+        Just fileModeText ->
+          case (readOct . unpack) fileModeText of
+            []              ->
+              pure $ Left "Invalid server-unix-socket-mode: not an octal"
+            (fileMode, _):_ ->
+              if fileMode < 384 || fileMode > 511
+                then pure $ Left "Invalid server-unix-socket-mode: needs to be between 600 and 777"
+                else pure $ Right fileMode
+
     parseJwtAudience :: C.Key -> C.Parser C.Config (Maybe StringOrURI)
     parseJwtAudience k =
       C.optional k C.string >>= \case
@@ -248,6 +266,9 @@ readOptions = do
           |## unix socket location
           |## if specified it takes precedence over server-port
           |# server-unix-socket = "/tmp/pgrst.sock"
+          |## unix socket file mode
+          |## when none is provided, 755 is applied by default
+          |# server-unix-socket-mode = "755"
           |
           |## base url for swagger output
           |# server-proxy-uri = ""