docs(server): clarify peer credential namespace semantics
- commit
- 4b5fcbc21f9147537793b57d6cd374fda948d4e2
- author
- brice · · 2026-09-30 09:07 UTC
- committer
- brice · · 2026-09-30 14:46 UTC
- parent
- ef8c520
- signature
- GPG Verified
CD88F9E564E0102646FB6077A1A07C7C7C3E349D· arch-gpg Verified for the committer email
1 file · +6 -3
M server/display.go +6 -3
| @@ -236,7 +236,9 @@ func (d *Display) Stopped() <-chan struct{} { return d.stopped } | |||
| 236 | 236 | func LiveResources() int { return len(live.resources) } | |
| 237 | 237 | ||
| 238 | 238 | // Credentials are the peer credentials of a client, read from the socket | |
| 239 | - | // (SO_PEERCRED) when it connected. | |
| 239 | + | // (SO_PEERCRED) when it connected. UID/GID are effective IDs in the server's | |
| 240 | + | // namespaces; an unmappable ID is the namespace overflow ID. PID may be zero | |
| 241 | + | // even for a valid client when its PID namespace is not visible to the server. | |
| 240 | 242 | type Credentials struct { | |
| 241 | 243 | PID int | |
| 242 | 244 | UID uint32 | |
| @@ -258,8 +260,9 @@ func (c Client) Credentials() (Credentials, error) { | |||
| 258 | 260 | return Credentials{PID: int(credScratch[0]), UID: uint32(credScratch[1]), GID: uint32(credScratch[2])}, nil | |
| 259 | 261 | } | |
| 260 | 262 | ||
| 261 | - | // PID is the process ID of the client, from Credentials. Zero for an invalid | |
| 262 | - | // client. Display goroutine only. | |
| 263 | + | // PID is the process ID of the client, from Credentials. It is zero for an | |
| 264 | + | // invalid client or a peer outside the server's visible PID namespaces. | |
| 265 | + | // Display goroutine only. | |
| 263 | 266 | func (c Client) PID() int { | |
| 264 | 267 | cr, err := c.Credentials() | |
| 265 | 268 | if err != nil { | |
| @@ -236,7 +236,9 @@ func (d *Display) Stopped() <-chan struct{} { return d.stopped } | |||||
| 236 | func LiveResources() int { return len(live.resources) } | 236 | func LiveResources() int { return len(live.resources) } | ||
| 237 | 237 | ||||
| 238 | // Credentials are the peer credentials of a client, read from the socket | 238 | // Credentials are the peer credentials of a client, read from the socket | ||
| 239 | - | // (SO_PEERCRED) when it connected. | 239 | + | // (SO_PEERCRED) when it connected. UID/GID are effective IDs in the server's |
| 240 | + | // namespaces; an unmappable ID is the namespace overflow ID. PID may be zero | |||
| 241 | + | // even for a valid client when its PID namespace is not visible to the server. | |||
| 240 | type Credentials struct { | 242 | type Credentials struct { | ||
| 241 | PID int | 243 | PID int | ||
| 242 | UID uint32 | 244 | UID uint32 | ||
| @@ -258,8 +260,9 @@ func (c Client) Credentials() (Credentials, error) { | |||||
| 258 | return Credentials{PID: int(credScratch[0]), UID: uint32(credScratch[1]), GID: uint32(credScratch[2])}, nil | 260 | return Credentials{PID: int(credScratch[0]), UID: uint32(credScratch[1]), GID: uint32(credScratch[2])}, nil | ||
| 259 | } | 261 | } | ||
| 260 | 262 | ||||
| 261 | - | // PID is the process ID of the client, from Credentials. Zero for an invalid | 263 | + | // PID is the process ID of the client, from Credentials. It is zero for an |
| 262 | - | // client. Display goroutine only. | 264 | + | // invalid client or a peer outside the server's visible PID namespaces. |
| 265 | + | // Display goroutine only. | |||
| 263 | func (c Client) PID() int { | 266 | func (c Client) PID() int { | ||
| 264 | cr, err := c.Credentials() | 267 | cr, err := c.Credentials() | ||
| 265 | if err != nil { | 268 | if err != nil { | ||