From 0887824324f15a8fdd15c2bfe7d8aa2bf77fb838 Mon Sep 17 00:00:00 2001
From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Wed, 19 Aug 2015 18:33:18 +0200
Subject: [PATCH] cmdmon: allow unauthenticated commands from Unix domain
 socket

Allow all commands received from the Unix domain command socket (which
is accessible only by the root and chrony user/group), even when they
are not authenticated with the command key.
---
 cmdmon.c | 47 +++++++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/cmdmon.c b/cmdmon.c
index 7c1a91d..d32ab66 100644
--- a/cmdmon.c
+++ b/cmdmon.c
@@ -1808,28 +1808,35 @@ read_from_cmd_socket(void *anything)
     /* This should be already handled */
     assert(0);
   } else {
-    /* Check level of authority required to issue the command */
-    switch(permissions[rx_command]) {
-      case PERMIT_AUTH:
-        if (authenticated) {
+    /* Check level of authority required to issue the command.  All commands
+       from the Unix domain socket (which is accessible only by the root and
+       chrony user/group) are allowed. */
+    if (where_from.sa.sa_family == AF_UNIX) {
+      assert(sock_fd == sock_fdu);
+      allowed = 1;
+    } else {
+      switch (permissions[rx_command]) {
+        case PERMIT_AUTH:
+          if (authenticated) {
+            allowed = 1;
+          } else {
+            allowed = 0;
+          }
+          break;
+        case PERMIT_LOCAL:
+          if (authenticated || localhost) {
+            allowed = 1;
+          } else {
+            allowed = 0;
+          }
+          break;
+        case PERMIT_OPEN:
           allowed = 1;
-        } else {
+          break;
+        default:
+          assert(0);
           allowed = 0;
-        }
-        break;
-      case PERMIT_LOCAL:
-        if (authenticated || localhost) {
-          allowed = 1;
-        } else {
-          allowed = 0;
-        }
-        break;
-      case PERMIT_OPEN:
-        allowed = 1;
-        break;
-      default:
-        assert(0);
-        allowed = 0;
+      }
     }
 
     if (allowed) {