bug#33847: 27.0.50; emacsclient does not find server socket

[Paul Eggert <eggert@cs.ucla.edu>]

Ulrich Mueller wrote:

> server.el seems to take all necessary precautions
> to ensure that the directory is safe:

>     (server-ensure-safe-dir DIR)
> 
>     Make sure DIR is a directory with no race-condition issues.
>     Creates the directory if necessary and makes sure:
>     - there’s no symlink involved
>     - it’s owned by us
>     - it’s not readable/writable by anybody else.

The problem on the server side isn't in server-ensure-safe-dir, it's that 
something could happen between the time that server-ensure-safe-dir checks that 
DIR is safe, and the time that DIR is actually used.

> In addition, emacsclient checks for the ownership of the socket before
> connecting to it.

Sure, but that doesn't mean it's the right socket. We discussed this last month; 
please see the thread containing:

https://lists.gnu.org/archive/html/emacs-devel/2018-11/msg00051.html

>>> No need for Emacs itself to be setgid, because the directory could
>>> be created by calling an auxiliary setgid program (similar to
>>> update-game-score).
> 
>> That might work, as a solution for people who want Emacs to keep
>> running even when they entirely log out.
> 
> It would also be rather complicated, and require creation of an emacs
> group.

True. I also would prefer a better solution than that.

> Emacs 26 uses ${TMPDIR}/emacs${UID}/ or ${HOME}/.emacs.d/server/
> depending on the server-use-tcp flag. Emacs 27 will use one of these
> two or ${XDG_RUNTIME_DIR} as a default (depending on the environment).
> IMHO this is approaching the point where things become unpredictable
> and hard to understand for the user. (And making it more customizable
> won't make it simpler, I fear.)

True, it has gotten more complicated. If we could simplify it without reopening 
the security holes that would be a good thing.

> can't the socket be placed
> in ${HOME}/.emacs.d/ which is already used in the TCP case? The socket
> could be named server-<system-name>, in order to avoid issues with NFS
> mounted directories.

That would cause problems when Emacs crashes or the system reboots, since the 
directory wouldn't be cleaned up automatically. So although we could add this as 
an option, I'm a bit leery of making it the default.