Net::Server is the backend for most popular PSGI servers on CPAN, such as starman. In shared hosting environments, it's a common pattern to have the www files owned by the relevant user, with the group being www-data, or whatever the HTTPd uses to access things. In the context of a reverse-proxy to a PSGI server, you can be a bit more strict by having only the AF_UNIX socket given the www group. However, this requires the execute bit to be set for the group (so you can't just set a umask), and Net::Server makes no attempt to chmod the socket it creates (but will helpfully fail to chown it when running as a nonroot user if you specify a different GID, as you can't chown or setgid as nonroot users).
This obviously has security implications in a shared environment:
- You have to start your PSGI server as root or a sudoer, and then instruct it to drop privs to the relevant user
- You then have to fix the socket after the fact by wrapping the invocation to daemonize.
- As such, you can't run things as user-mode systemd units; automating this for clients necessarily can't be self-service without some kind of script to "poke a hole in the sheet".
Back at cPanel we called such helpers "adminbins".
Yet more "complexity demon" that could (and arguably should) be fixed by patching the upstream.
These schleps rarely get fixed in practice, as people don't write articles about it like this.
They just fix it and move on; that's the internet way -- route around damage and become a rat's nest of complexity rather than fix it.
A patch will have to be submitted to add an option to set the group execute bit on the socket so created, likely
here.
Consumers of Net::Server would then need to plumb up to this; getting this all coordinated is quite the schlep in itself, which is why we usually don't get such nice things.
There is a clever way to have our cake and eat it too regarding not needing an adminbin.
Make the user which owns the directory have the www-data group as their primary group, and make sure to set the group perms on their www files to be 0.
Then you won't have to setgid or chown anything at all, and can happily run a usermode service all day.
