Skip to content

Peer credentials on Unix socket #42839

Open
@Kixunil

Description

@Kixunil
Contributor

tokio-rs/tokio-uds#13 was recently merged, so I'd like to open an issue of adding same thing to stdlib. TL;DR It allows one to get effective UID and GID of the process which created the remote socket.

I suggest to test it with Tokio now and when there is consensus, we can merge similar change. I need this function, so I'm going to test it anyway.

Activity

added
T-libs-apiRelevant to the library API team, which will review and decide on the PR/issue.
on Jun 22, 2017
Kixunil

Kixunil commented on Jul 11, 2017

@Kixunil
ContributorAuthor

Considering that newtypes for pid_t, uid_t and gid_t landed in nix, we shoul consider using same newtypes in std and then simply reexport them in nix.

sfackler

sfackler commented on Jul 11, 2017

@sfackler
Member

This seems like a reasonable addition. It looks like there are some extra platforms that require special handling though - Solaris and FreeBSD: https://doxygen.postgresql.org/getpeereid_8c_source.html

Kixunil

Kixunil commented on Jul 11, 2017

@Kixunil
ContributorAuthor

The implementation in tokio handles Linux and FreeBSD (incl. macOS). I doesn't handle Solaris because I don't have Solaris machine.

added
C-feature-acceptedCategory: A feature request that has been accepted pending implementation.
and removed
C-feature-requestCategory: A feature request, i.e: not implemented / a PR.
on Nov 19, 2017
dtolnay

dtolnay commented on Nov 19, 2017

@dtolnay
Member

This isn't my area of expertise but I would be interested to see an API proposed for this in a PR.

joechrisellis

joechrisellis commented on Jul 28, 2020

@joechrisellis
Contributor

Hi guys. We're quite keen for something like this in the stdlib. The implementation in the Tokio repository looks good to me, and from a cursory glance it looks like the stdlib can be very similar. I'm happy to give this a crack -- should I submit an RFC first or is a normal code pull request OK? 😄

Cheers! 🙂

hug-dev

hug-dev commented on Aug 28, 2020

@hug-dev
Contributor

The PR which implements this issue is ready for review 🚀
#75148

Kixunil

Kixunil commented on Sep 16, 2020

@Kixunil
ContributorAuthor

Since the PR was merged should the labels (and perhaps also the title) be updated to tracking issue?

hug-dev

hug-dev commented on Sep 16, 2020

@hug-dev
Contributor

I would agree with that!
I guess the steps to follow for stabilization are here?

11 remaining items

Kixunil

Kixunil commented on Dec 8, 2020

@Kixunil
ContributorAuthor

I'm not sure if all (Unixy) OSes support getting a peer's PID.

They don't, that's the reason there's Option in the first place. The structs seem to be sufficiently different to be different types but I may be missing something.

woodruffw

woodruffw commented on Dec 8, 2020

@woodruffw
Contributor

They don't, that's the reason there's Option in the first place.

I'm not sure if it's 100% of Unices, but I think almost all of them support some mechanism for getting the peer's PID. It's just not through struct ucred, hence my comment about UCred being a misleading wrapper.

For example, macOS doesn't have a PID in its struct ucred, but it does support getting the peer's PID through the LOCAL_PEERPID sockopt. All of the BSDs expose similar mechanisms.

Kixunil

Kixunil commented on Dec 8, 2020

@Kixunil
ContributorAuthor

UCred being a misleading wrapper.

Sure, I agree with renaming.

but it does support getting the peer's PID through the LOCAL_PEERPID sockopt.

Yes, this is implemented. :)

All of the BSDs expose similar mechanisms.

A PR would be nice if you happen to have some experience with this. Shouldn't be big, most of the stuff is already there.

woodruffw

woodruffw commented on Dec 8, 2020

@woodruffw
Contributor

A PR would be nice if you happen to have some experience with this. Shouldn't be big, most of the stuff is already there.

I can definitely try! I have #79387 open for macOS right now, and I'll try to get some similar ones in the pipeline for the BSDs.

added a commit that references this issue on Dec 9, 2020

Auto merge of rust-lang#79387 - woodruffw-forks:ww/peer-cred-pid-maco…

msolters

msolters commented on Oct 21, 2022

@msolters

What is the current status of this feature peer_credentials_unix_socket graduating to stable? I was surprised to find this issue is 5 years old.
It's a great feature but it sucks having to be on nightly to get it!

Kixunil

Kixunil commented on Oct 21, 2022

@Kixunil
ContributorAuthor

Looks like there were at least no complaints about it apart from UCred being misleading name. Looking at the docs the struct description could use some polishing. Maybe open an ACP? If you have some experience with using it on nightly that should help. I changed my interests over time and don't have it.

woodruffw

woodruffw commented on Dec 29, 2022

@woodruffw
Contributor

I'm happy to help with the stabilization here as well.

@msolters: if you do an ACP for renaming UCred, I'd suggest PeerCred (per #42839 (comment)). Otherwise, I can do the ACP and from there begin the stabilization process (at least the outsider bits).

added a commit that references this issue on Mar 7, 2024

Rollup merge of rust-lang#122147 - kadiwa4:private_impl_mods, r=worki…

92d7e02
added a commit that references this issue on Mar 8, 2024
emc2

emc2 commented on Dec 13, 2024

@emc2

Is there any chance of this being stabilized anytime soon? I'm using this feature in a project, and I'd like to be able to back down to rust-stable.

andrewbaxter

andrewbaxter commented on Feb 3, 2025

@andrewbaxter

I'm interested in this feature, but I realized I'd be more interested in pidfd to avoid pid reuse issues. It wasn't available at the time this issue was created but it appears that linux now supports SO_PEERPIDFD torvalds/linux@ba47545 . Would it be reasonable to tack that on here, or are there use cases for pid that aren't better served by pidfd?

Kixunil

Kixunil commented on Feb 3, 2025

@Kixunil
ContributorAuthor

@andrewbaxter that'd require the struct to not be Copy, so I think it'd be better to just provide a separate method. (Also because the method is Linux-only anyway.) BTW great to hear that Linux devs are fixing those races! Shame it's just Linux.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    C-tracking-issueCategory: An issue tracking the progress of sth. like the implementation of an RFCT-libs-apiRelevant to the library API team, which will review and decide on the PR/issue.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @andrewbaxter@Kixunil@sfackler@emc2@jonas-schievink

        Issue actions

          Peer credentials on Unix socket · Issue #42839 · rust-lang/rust