peer_linux.go RawHistoryFolder

1//go:build linux
2
3package ipc
4
5import (
6	"fmt"
7	"net"
8	"os"
9	"syscall"
10)
11
12// verifySameUserUnixPeer returns nil only when the peer at the other end of an
13// AF_UNIX connection is the current effective user, as reported by the kernel
14// through SO_PEERCRED.
15//
16// The check is deliberately explicit and relies on no filesystem permission and
17// no X11-style convention that a private socket directory makes the peer
18// trustworthy: the kernel's own credential record for this connection is the
19// authority. A socket whose credentials cannot be read is refused, so a build
20// that cannot prove the peer is same-user fails closed.
21func verifySameUserUnixPeer(conn *net.UnixConn) error {
22	if conn == nil {
23		return ErrMuxPeerRejected
24	}
25	raw, err := conn.SyscallConn()
26	if err != nil {
27		return fmt.Errorf("%w: %v", ErrMuxPeerRejected, err)
28	}
29	var credential *syscall.Ucred
30	var controlErr error
31	if err := raw.Control(func(fd uintptr) {
32		credential, controlErr = syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
33	}); err != nil {
34		return fmt.Errorf("%w: %v", ErrMuxPeerRejected, err)
35	}
36	if controlErr != nil {
37		return fmt.Errorf("%w: %v", ErrMuxPeerRejected, controlErr)
38	}
39	if credential == nil {
40		return ErrMuxPeerRejected
41	}
42	if uid := uint32(os.Geteuid()); uid != credential.Uid {
43		return fmt.Errorf("%w: peer uid %d, want %d", ErrMuxPeerRejected, credential.Uid, uid)
44	}
45	return nil
46}