peer_darwin.go RawHistoryFolder

1//go:build darwin
2
3package ipc
4
5import (
6	"fmt"
7	"net"
8	"os"
9
10	"golang.org/x/sys/unix"
11)
12
13// verifySameUserUnixPeer returns nil only when the peer at the other end of an
14// AF_UNIX connection is the current effective user, as reported by the kernel
15// through LOCAL_PEERCRED. A socket whose credentials cannot be read is refused.
16func verifySameUserUnixPeer(conn *net.UnixConn) error {
17	if conn == nil {
18		return ErrMuxPeerRejected
19	}
20	raw, err := conn.SyscallConn()
21	if err != nil {
22		return fmt.Errorf("%w: %v", ErrMuxPeerRejected, err)
23	}
24	var credential *unix.Xucred
25	var controlErr error
26	if err := raw.Control(func(fd uintptr) {
27		credential, controlErr = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
28	}); err != nil {
29		return fmt.Errorf("%w: %v", ErrMuxPeerRejected, err)
30	}
31	if controlErr != nil {
32		return fmt.Errorf("%w: %v", ErrMuxPeerRejected, controlErr)
33	}
34	if credential == nil {
35		return ErrMuxPeerRejected
36	}
37	if uid := uint32(os.Geteuid()); uid != credential.Uid {
38		return fmt.Errorf("%w: peer uid %d, want %d", ErrMuxPeerRejected, credential.Uid, uid)
39	}
40	return nil
41}