From c4fbdc2d3a0d3e54bb9ad1238be87390bd04dc9b Mon Sep 17 00:00:00 2001
From: Jamie Nguyen <j@jamielinux.com>
Date: Fri, 13 Nov 2015 13:57:11 +0000
Subject: [PATCH 3/3] Defer creation of Unix socket until after setuid

---
 changes/bug17562-defer-unix-socket-creation | 4 ++++
 src/or/connection.c                         | 8 ++++++++
 2 files changed, 12 insertions(+)
 create mode 100644 changes/bug17562-defer-unix-socket-creation

diff --git a/changes/bug17562-defer-unix-socket-creation b/changes/bug17562-defer-unix-socket-creation
new file mode 100644
index 0000000..f1896c0
--- /dev/null
+++ b/changes/bug17562-defer-unix-socket-creation
@@ -0,0 +1,4 @@
+  o Minor bug fixes:
+    - Defer creation of Unix sockets until after setuid. This avoids needing
+      CAP_CHOWN and CAP_FOWNER when using systemd's CapabilityBoundingSet, or
+      chown and fowner when using SELinux.
diff --git a/src/or/connection.c b/src/or/connection.c
index 78176d3..f2a82dd 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -2381,6 +2381,14 @@ retry_listener_ports(smartlist_t *old_conns,
     if (port->server_cfg.no_listen)
       continue;
 
+#ifndef _WIN32
+    /* We don't need to be root to create a UNIX socket, so defer until after
+     * setuid. */
+    const or_options_t *options = get_options();
+    if (port->is_unix_addr && !geteuid() && strcmp(options->User, "root"))
+      continue;
+#endif
+
     if (port->is_unix_addr) {
       listensockaddr = (struct sockaddr *)
         create_unix_sockaddr(port->unix_addr,
-- 
2.5.0