Re: getpeereid() for Linux

[Andi Kleen]

On Wed, Sep 05, 2001 at 12:05:50PM +0200, Florian Weimer wrote:
> Andi Kleen <[e-mail]> writes:
> 
> > Florian Weimer <[e-mail]> writes:
> > 
> > > Would anyone like to give me a helping hand in implementing the
> > > getpeereid() syscall for Linux?  See the following page for the
> > > documentation of the OpenBSD implementation:
> > 
> > It is implemented for unix sockets (see unix(7))
> 
> Hmm, it is not documented in my local copy (?).  getpeereid() is
> different from the standard credential passing mechanism because it
> does not require cooperation of the other end.

SO_PEERCRED doesn't need any cooperation from the other end (at least 
not for SOCK_STREAM) 

> > For TCP it is rather useless because it would work only locally.
> 
> Obviously, we need it only locally. ;-) The interface is useful if you
> are implementing poor man's VPN in user space.

There is netfilter owner match, but it is a bad hack.

I think you're better off with identd. 

> 
> > If you trust the localhost you're probably better off using the
> > ident protocol for it.
> 
> This means running just another server, even with root privileges. :-(

identd doesn't need root.

-Andi