From: Sam Roberts <sroberts@...>
Date: 2006-06-10T06:25:55+09:00
Subject: Re: Patch for Unix socket peer credentials

On Sat, Jun 10, 2006 at 04:28:36AM +0900, James F. Hranicky wrote:
> This patch adds support for getting the uid and gid of the peer
> socket connected to a Unix domain socket.
> 
> The patch is really just a suggestion, as you can't necessarily get the
> same kinds of information across platforms. Unless I'm mistaken this is
> what you can get for the following platforms:
> 
> 	FreeBSD, OSX (getpeereid)   : euid, egid
> 	Linux        (getsockopt)   : pid, uid, gid
> 	Solaris 10   (getpeerucred) : uid, euid, gid, egid, pid and more
> 
> The patch adds checks to extconf.rb for the getpeereid and getpeerucred
> functions and a check for the SO_PEERCRED macro. If none of these are
> found calls to the peer_uid and peer_gid method raise an error. 
> 
> Questions and comments welcome, and I'm open to suggestions for
> changes/improvements.

I tried to do this on OS X recently using DGRAM AF_LOCAL sockets based
on the examples from Stevens, and failed, possibly due to an error on my
part, or maybe because the only way to do it is with getpeereid() on a
connected stream-oriented socket?

So, this is serendipitous, and very useful. Will try the patch
this weekend.

A bits of feedback:

- Maybe instead of #peer_uid, and #peer_gid, have just #peer_id =>
  [uid,gid], seems more convenient to me to get them both in one shot,
  matches (some of) the underlying system calls more closely, and also
  rids you of the duplicate code adn documentation (btw, thanks for
  including docs!).

- Maybe instead of raising an error if not supported (which means you
  have to call it to find that out), just don't define the method at
  all?  Kindof like socket options, you can do Socket.constants.include?
  to see if a sockopt is supported before even attempting to use it, it
  might be nice to do (Socket/UNIXSocket).methods.include? :peer_id to
  see if #peer_id is supported.

- I think the methods should be lower down in the hierarchy, or at least
  duplicated in Socket, if I create an AF_LOCAL connection-oriented
  socket with Socket.new, I should be able to get the peer ID, too, I
  think.

- I am using DGRAM unix domain sockets... it sure would be nice to have
  a way to determine the peer's credentials for received messages, any
  thoughts on that? Even non-ruby thoughts... do you know if it works
  on the Linux and OS X, and how to make it work?

Please and Thank You,
Sam