Change file mode before changing file owner

[pemensik]

Change mode first when configuring remote control unix socket. Some
security systems might strip capability of changing other user's system
even to process with effective uid 0. That is done on Fedora by SELinux
policy and systemd for example. SELinux audit then shows errors, because
unbound tries modifying permissions of not own file. Fix just by mode
change as first step, make it owned by unbound:unbound user as the last
step only.

Related: rhbz#1905441

[pemensik]

Relevant audit log would look like:

type=PROCTITLE msg=audit(12/11/2020 04:34:30.280:1043) : proctitle=/usr/sbin/unbound -d 
type=PATH msg=audit(12/11/2020 04:34:30.280:1043) : item=0 name=/run/unbound/unbound.control.pipe inode=72069 dev=00:18 mode=socket,755 ouid=unbound ogid=unbound rdev=00:00 obj=system_u:object_r:named_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(12/11/2020 04:34:30.280:1043) : cwd=/etc/unbound 
type=SYSCALL msg=audit(12/11/2020 04:34:30.280:1043) : arch=x86_64 syscall=chmod success=yes exit=0 a0=0x55c3d2ca00a0 a1=0660 a2=0x3e2 a3=0x0 items=1 ppid=1 pid=30404 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=unbound exe=/usr/sbin/unbound subj=system_u:system_r:named_t:s0 key=(null) 
type=AVC msg=audit(12/11/2020 04:34:30.280:1043) : avc:  denied  { fsetid } for  pid=30404 comm=unbound capability=fsetid  scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=capability permissive=0 
type=AVC msg=audit(12/11/2020 04:34:30.280:1043) : avc:  denied  { fsetid } for  pid=30404 comm=unbound capability=fsetid  scontext=system_u:system_r:named_t:s0 tcontext=system_u:system_r:named_t:s0 tclass=capability permissive=0 

Taken from RH bug.

[wcawijngaards]

Okay, that looks fine to do that first.

[wcawijngaards]

Merged the fix and also applied a similar fix to NSD, for its remote control unix socket code. That fix is in NLnetLabs/nsd@877c873 . Thank you for the fix up!