Re: getpeereid() for Linux

[Florian Weimer]

Andi Kleen <[e-mail]> writes:

> Florian Weimer <[e-mail]> writes:
> 
> > Would anyone like to give me a helping hand in implementing the
> > getpeereid() syscall for Linux?  See the following page for the
> > documentation of the OpenBSD implementation:
> 
> It is implemented for unix sockets (see unix(7))

Hmm, it is not documented in my local copy (?).  getpeereid() is
different from the standard credential passing mechanism because it
does not require cooperation of the other end.

> For TCP it is rather useless because it would work only locally.

Obviously, we need it only locally. ;-) The interface is useful if you
are implementing poor man's VPN in user space.

> If you trust the localhost you're probably better off using the
> ident protocol for it.

This means running just another server, even with root privileges. :-(

-- 
Florian Weimer 	                  [e-mail]
University of Stuttgart           http://cert.uni-stuttgart.de/
RUS-CERT                          [phone]/fax [phone]