only allow admin access via unix socket

cmd/keyctl/main.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"syscall"
 	"time"
 
@@ -23,6 +24,7 @@ var (
 	version string
 
 	listen string
+	socket string
 	path   string
 
 	log logr.Logger
@@ -58,6 +60,7 @@ func main() {
 		fs := flag.NewFlagSet("", flag.ExitOnError)
 		klog.InitFlags(fs)
 		fs.StringVar(&listen, "listen", ":7070", "listen ip:port")
+		fs.StringVar(&socket, "socket", "keyctl.sock", "listen unix domain socket")
 		fs.StringVar(&path, "path", "/var/keyctl", "db storage dir")
 		fs.Parse(os.Args[2:])
 	default:
@@ -66,7 +69,7 @@ func main() {
 
 	log = klogr.New().WithName("main")
 	log.Info("starting keyctl", "version", version)
-	srv, err := api.NewServer(klogr.New().WithName("srv"), listen)
+	srv, err := api.NewServer(klogr.New().WithName("srv"), listen, filepath.Join(path, socket))
 	if err != nil {
 		klog.Fatalf("init failed: %s", err)
 	}