Add ability to configure Unix socket permissions

Currently if OPA listens on a Unix socket, the socket
file is created with 755 permissions. So if OPA is deployed
on k8s for example and the socket path is shared
via a volume between pods, due to the default permissions,
the socket will not be reachable for the caller. One way around
this is to match the user id for the OPA and caller containers
but that is not always possible.

This change adds a new flag to the OPA runtime that allows
to configure the permission of the socket file. In the
k8s scenario, if the file permission is updated to 777
for instance, the caller will be able to connect to OPA via
the socket.

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>

server/server.go

@@ -143,6 +143,7 @@ type Server struct {
 	allPluginsOkOnce       bool
 	distributedTracingOpts tracing.Options
 	ndbCacheEnabled        bool
+	unixSocketPerm         *string
 }
 
 // Metrics defines the interface that the server requires for recording HTTP
@@ -366,6 +367,13 @@ func (s *Server) WithNDBCacheEnabled(ndbCacheEnabled bool) *Server {
 	return s
 }
 
+// WithUnixSocketPermission sets the permission for the Unix domain socket if used to listen for
+// incoming connections. Applies to the sockets the server is listening on including diagnostic API's.
+func (s *Server) WithUnixSocketPermission(unixSocketPerm *string) *Server {
+	s.unixSocketPerm = unixSocketPerm
+	return s
+}
+
 // Listeners returns functions that listen and serve connections.
 func (s *Server) Listeners() ([]Loop, error) {
 	loops := []Loop{}
@@ -634,6 +642,17 @@ func (s *Server) getListenerForUNIXSocket(u *url.URL, h http.Handler, t httpList
 		return nil, nil, err
 	}
 
+	if s.unixSocketPerm != nil {
+		modeVal, err := strconv.ParseUint(*s.unixSocketPerm, 8, 32)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		if err := os.Chmod(socketPath, os.FileMode(modeVal)); err != nil {
+			return nil, nil, err
+		}
+	}
+
 	l := newHTTPUnixSocketListener(&domainSocketServer, unixListener, t)
 
 	domainSocketLoop := func() error { return domainSocketServer.Serve(unixListener) }