Implement SO_PEERCRED socket option for UNIX sockets and its tests.

AnilAltinay · gvisor-bot · commit 6db745970118 · 2025-11-04T17:24:56.000-08:00
PiperOrigin-RevId: 828197810
diff --git a/pkg/sentry/socket/hostinet/socket.go b/pkg/sentry/socket/hostinet/socket.go
@@ -24,6 +24,7 @@ import (
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/fdnotifier"
 	"gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/pkg/marshal"
 	"gvisor.dev/gvisor/pkg/marshal/primitive"
 	"gvisor.dev/gvisor/pkg/safemem"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -828,3 +829,8 @@ func init() {
 		registered[fam] = struct{}{}
 	}
 }
+
+// GetPeerCreds implements socket.Socket.GetPeerCreds
+func (s *Socket) GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error) {
+	return nil, syserr.ErrNotSupported
+}
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
@@ -568,6 +568,11 @@ func (s *Socket) GetPeerName(t *kernel.Task) (linux.SockAddr, uint32, *syserr.Er
 	return sa, uint32(sa.SizeBytes()), nil
 }
 
+// GetPeerCreds implements socket.Socket.GetPeerCreds.
+func (s *Socket) GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error) {
+	return nil, syserr.ErrNotSupported
+}
+
 // RecvMsg implements socket.Socket.RecvMsg.
 func (s *Socket) RecvMsg(t *kernel.Task, dst usermem.IOSequence, flags int, haveDeadline bool, deadline ktime.Time, senderRequested bool, controlDataLen uint64) (int, int, linux.SockAddr, uint32, socket.ControlMessages, *syserr.Error) {
 	from := &linux.SockAddrNetlink{
diff --git a/pkg/sentry/socket/netstack/netstack.go b/pkg/sentry/socket/netstack/netstack.go
@@ -980,14 +980,7 @@ func getSockOptSocket(t *kernel.Task, s socket.Socket, ep commonEndpoint, family
 		if family != linux.AF_UNIX || outLen < unix.SizeofUcred {
 			return nil, syserr.ErrInvalidArgument
 		}
-
-		tcred := t.Credentials()
-		creds := linux.ControlMessageCredentials{
-			PID: int32(t.ThreadGroup().ID()),
-			UID: uint32(tcred.EffectiveKUID.In(tcred.UserNamespace).OrOverflow()),
-			GID: uint32(tcred.EffectiveKGID.In(tcred.UserNamespace).OrOverflow()),
-		}
-		return &creds, nil
+		return s.GetPeerCreds(t)
 
 	case linux.SO_PASSCRED:
 		if outLen < sizeOfInt32 {
@@ -3051,6 +3044,10 @@ func (s *sock) GetPeerName(*kernel.Task) (linux.SockAddr, uint32, *syserr.Error)
 	return a, l, nil
 }
 
+func (s *sock) GetPeerCreds(*kernel.Task) (marshal.Marshallable, *syserr.Error) {
+	return nil, syserr.ErrNotSupported
+}
+
 func (s *sock) fillCmsgInq(cmsg *socket.ControlMessages) {
 	if !s.sockOptInq {
 		return
diff --git a/pkg/sentry/socket/plugin/stack/socket.go b/pkg/sentry/socket/plugin/stack/socket.go
@@ -569,6 +569,11 @@ func (s *socketOperations) GetPeerName(t *kernel.Task) (linux.SockAddr, uint32,
 	return socket.UnmarshalSockAddr(s.family, addr), addrlen, nil
 }
 
+// GetPeerCreds implements socket.Socket.GetPeerCreds.
+func (s *socketOperations) GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error) {
+	return nil, syserr.ErrInvalidEndpointState
+}
+
 // recv is a helper function for doing non-blocking read once.
 // It returns:
 // 1. number of bytes received;
diff --git a/pkg/sentry/socket/socket.go b/pkg/sentry/socket/socket.go
@@ -257,6 +257,9 @@ type Socket interface {
 	// necessarily the actual length of the address.
 	GetPeerName(t *kernel.Task) (addr linux.SockAddr, addrLen uint32, err *syserr.Error)
 
+	// GetPeerCreds returns the peer credentials of the socket.
+	GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error)
+
 	// RecvMsg implements the recvmsg(2) linux unix.
 	//
 	// senderAddrLen is the address length to be returned to the application,
diff --git a/pkg/sentry/socket/unix/BUILD b/pkg/sentry/socket/unix/BUILD
@@ -42,6 +42,7 @@ go_library(
         "//pkg/sentry/fsutil",
         "//pkg/sentry/inet",
         "//pkg/sentry/kernel",
+        "//pkg/sentry/kernel/auth",
         "//pkg/sentry/ktime",
         "//pkg/sentry/socket",
         "//pkg/sentry/socket/control",
diff --git a/pkg/sentry/socket/unix/transport/BUILD b/pkg/sentry/socket/unix/transport/BUILD
@@ -97,6 +97,7 @@ go_library(
         "//pkg/log",
         "//pkg/refs",
         "//pkg/sentry/hostfd",
+        "//pkg/sentry/kernel/auth",
         "//pkg/sentry/uniqueid",
         "//pkg/sync",
         "//pkg/sync/locking",
diff --git a/pkg/sentry/socket/unix/transport/connectioned.go b/pkg/sentry/socket/unix/transport/connectioned.go
@@ -106,6 +106,14 @@ type connectionedEndpoint struct {
 	// tcpip.SockStream.
 	stype linux.SockType
 
+	// peerCreds is used to store the peer credentials.
+	// This will store the socket's own credentials until the connection is
+	// established with connect(2). Once the connection is established, this
+	// will store the peer's credentials. The use of this option is possible
+	// only for connected `AF_UNIX` stream sockets and for `AF_UNIX` stream and
+	// datagram socket pairs created using socketpair(2)
+	peerCreds CredentialsControlMessage
+
 	// acceptedChan is per the TCP endpoint implementation. Note that the
 	// sockets in this channel are _already in the connected state_, and
 	// have another associated connectionedEndpoint.
@@ -274,6 +282,16 @@ func (e *connectionedEndpoint) Close(ctx context.Context) {
 	}
 }
 
+func (e *connectionedEndpoint) swapPeerCredsLocked(ctx context.Context, cend ConnectingEndpoint, ne *connectionedEndpoint) *syserr.Error {
+	ce, ok := cend.(*connectionedEndpoint)
+	if !ok {
+		return syserr.ErrInvalidEndpointState
+	}
+	// Swap peer credentials between the two endpoints.
+	ne.peerCreds, ce.peerCreds = ce.peerCreds, ne.peerCreds
+	return nil
+}
+
 // BidirectionalConnect implements BoundEndpoint.BidirectionalConnect.
 func (e *connectionedEndpoint) BidirectionalConnect(ctx context.Context, ce ConnectingEndpoint, returnConnect func(Receiver, ConnectedEndpoint), opts UnixSocketOpts) *syserr.Error {
 	if ce.Type() != e.stype {
@@ -327,6 +345,7 @@ func (e *connectionedEndpoint) BidirectionalConnect(ctx context.Context, ce Conn
 	ne.ops.SetSendBufferSize(defaultBufferSize, false /* notify */)
 	ne.ops.SetReceiveBufferSize(defaultBufferSize, false /* notify */)
 	ne.SocketOptions().SetPassCred(e.SocketOptions().GetPassCred())
+	ne.peerCreds = e.peerCreds
 
 	readQueue := &queue{ReaderQueue: ce.WaiterQueue(), WriterQueue: ne.Queue, limit: defaultBufferSize}
 	readQueue.InitRefs()
@@ -354,6 +373,9 @@ func (e *connectionedEndpoint) BidirectionalConnect(ctx context.Context, ce Conn
 		}
 		readQueue.IncRef()
 		if e.stype == linux.SOCK_STREAM {
+			if err := e.swapPeerCredsLocked(ctx, ce, ne); err != nil {
+				return err
+			}
 			returnConnect(&streamQueueReceiver{queueReceiver: queueReceiver{readQueue: readQueue}}, connected)
 		} else {
 			returnConnect(&queueReceiver{readQueue: readQueue}, connected)
@@ -655,3 +677,15 @@ func (e *connectionedEndpoint) EventUnregister(we *waiter.Entry) {
 func (e *connectionedEndpoint) GetAcceptConn() bool {
 	return e.Listening()
 }
+
+func (e *connectionedEndpoint) PeerCreds() CredentialsControlMessage {
+	e.Lock()
+	defer e.Unlock()
+	return e.peerCreds
+}
+
+func (e *connectionedEndpoint) SetPeerCreds(creds CredentialsControlMessage) {
+	e.Lock()
+	defer e.Unlock()
+	e.peerCreds = creds
+}
diff --git a/pkg/sentry/socket/unix/transport/connectionless.go b/pkg/sentry/socket/unix/transport/connectionless.go
@@ -158,6 +158,14 @@ func (*connectionlessEndpoint) Accept(context.Context, *Address, UnixSocketOpts)
 	return nil, syserr.ErrNotSupported
 }
 
+func (e *connectionlessEndpoint) PeerCreds() CredentialsControlMessage {
+	return nil
+}
+
+func (e *connectionlessEndpoint) SetPeerCreds(creds CredentialsControlMessage) {
+	// no-op
+}
+
 // Bind binds the connection.
 //
 // For Unix endpoints, this _only sets the address associated with the socket_.
diff --git a/pkg/sentry/socket/unix/transport/unix.go b/pkg/sentry/socket/unix/transport/unix.go
@@ -52,6 +52,16 @@ type CredentialsControlMessage interface {
 	Equals(CredentialsControlMessage) bool
 }
 
+// A PeerCredentialer is a socket or endpoint that supports the SO_PEERCREDS socket
+// option.
+type PeerCredentialer interface {
+	// PeerCreds returns the peer credentials.
+	PeerCreds() CredentialsControlMessage
+
+	// SetPeerCreds sets the peer credentials.
+	SetPeerCreds(creds CredentialsControlMessage)
+}
+
 // A ControlMessages represents a collection of socket control messages.
 //
 // +stateify savable
@@ -151,6 +161,7 @@ type UnixSocketOpts struct {
 // etc. to Unix socket implementations.
 type Endpoint interface {
 	Credentialer
+	PeerCredentialer
 	waiter.Waitable
 
 	// Close puts the endpoint in a closed state and frees all resources
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
@@ -32,6 +32,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/sockfs"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
+	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/ktime"
 	"gvisor.dev/gvisor/pkg/sentry/socket"
 	"gvisor.dev/gvisor/pkg/sentry/socket/control"
@@ -422,6 +423,10 @@ func (*provider) Pair(t *kernel.Task, stype linux.SockType, protocol int) (*vfs.
 		ep2.Close(t)
 		return nil, nil, err
 	}
+	// Initialize the peer credentials.
+	creds := control.MakeCreds(t)
+	ep1.SetPeerCreds(creds)
+	ep2.SetPeerCreds(creds)
 
 	return s1, s2, nil
 }
@@ -507,6 +512,30 @@ func (s *Socket) GetPeerName(t *kernel.Task) (linux.SockAddr, uint32, *syserr.Er
 	return a, l, nil
 }
 
+// GetPeerCreds returns the peer credentials of the socket backed by a
+// transport.Endpoint.
+func (s *Socket) GetPeerCreds(t *kernel.Task) (marshal.Marshallable, *syserr.Error) {
+	pCreds := s.ep.PeerCreds()
+	if pCreds == nil {
+		// https://elixir.bootlin.com/linux/v6.16-rc7/source/net/core/sock.c#L1905
+		return &linux.ControlMessageCredentials{
+			PID: 0,
+			UID: auth.NoID,
+			GID: auth.NoID,
+		}, nil
+	}
+	scmCreds, ok := pCreds.(control.SCMCredentials)
+	if !ok {
+		return nil, syserr.ErrInvalidEndpointState
+	}
+	pid, uid, gid := scmCreds.Credentials(t)
+	return &linux.ControlMessageCredentials{
+		PID: int32(pid),
+		UID: uint32(uid),
+		GID: uint32(gid),
+	}, nil
+}
+
 // GetSockName implements the linux syscall getsockname(2) for sockets backed by
 // a transport.Endpoint.
 func (s *Socket) GetSockName(t *kernel.Task) (linux.SockAddr, uint32, *syserr.Error) {
@@ -522,7 +551,11 @@ func (s *Socket) GetSockName(t *kernel.Task) (linux.SockAddr, uint32, *syserr.Er
 // Listen implements the linux syscall listen(2) for sockets backed by
 // a transport.Endpoint.
 func (s *Socket) Listen(t *kernel.Task, backlog int) *syserr.Error {
-	return s.ep.Listen(t, backlog)
+	if err := s.ep.Listen(t, backlog); err != nil {
+		return err
+	}
+	s.ep.SetPeerCreds(control.MakeCreds(t))
+	return nil
 }
 
 // extractEndpoint retrieves the transport.BoundEndpoint associated with a Unix
@@ -581,6 +614,9 @@ func (s *Socket) Connect(t *kernel.Task, sockaddr []byte, blocking bool) *syserr
 	}
 	defer ep.Release(t)
 
+	// Initialize the peer credentials of client endpoint.
+	s.ep.SetPeerCreds(control.MakeCreds(t))
+
 	// Connect the server endpoint.
 	err = s.ep.Connect(t, ep, t.Kernel().UnixSocketOpts)
 
diff --git a/test/syscalls/linux/BUILD b/test/syscalls/linux/BUILD
@@ -394,6 +394,47 @@ cc_binary(
     ],
 )
 
+cc_library(
+    name = "socket_unix_peercred_test_cases",
+    testonly = 1,
+    srcs = [
+        "socket_unix_peercred.cc",
+    ],
+    hdrs = [
+        "socket_unix_peercred.h",
+    ],
+    deps = select_gtest() + [
+        "//test/util:capability_util",
+        "//test/util:cleanup",
+        "//test/util:eventfd_util",
+        "//test/util:file_descriptor",
+        "//test/util:fs_util",
+        "//test/util:logging",
+        "//test/util:memory_util",
+        "//test/util:mount_util",
+        "//test/util:multiprocess_util",
+        "//test/util:posix_error",
+        "//test/util:proc_util",
+        "//test/util:save_util",
+        "//test/util:socket_util",
+        "//test/util:temp_path",
+        "//test/util:test_util",
+        "//test/util:thread_util",
+        "//test/util:time_util",
+        "//test/util:timer_util",
+        "@com_google_absl//absl/algorithm:container",
+        "@com_google_absl//absl/container:btree",
+        "@com_google_absl//absl/container:flat_hash_set",
+        "@com_google_absl//absl/container:node_hash_set",
+        "@com_google_absl//absl/flags:flag",
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:str_format",
+        "@com_google_absl//absl/synchronization",
+        "@com_google_absl//absl/time",
+    ],
+    alwayslink = 1,
+)
+
 cc_binary(
     name = "chdir_test",
     testonly = 1,
@@ -3930,6 +3971,7 @@ cc_binary(
     malloc = "//test/util:errno_safe_allocator",
     deps = select_gtest() + [
         ":socket_unix_cmsg_test_cases",
+        ":socket_unix_peercred_test_cases",
         ":socket_unix_test_cases",
         ":unix_domain_socket_test_util",
         "//test/util:socket_util",
diff --git a/test/syscalls/linux/socket_unix_pair.cc b/test/syscalls/linux/socket_unix_pair.cc
@@ -16,6 +16,7 @@
 
 #include "test/syscalls/linux/socket_unix.h"
 #include "test/syscalls/linux/socket_unix_cmsg.h"
+#include "test/syscalls/linux/socket_unix_peercred.h"
 #include "test/syscalls/linux/unix_domain_socket_test_util.h"
 #include "test/util/socket_util.h"
 #include "test/util/test_util.h"
@@ -39,6 +40,10 @@ INSTANTIATE_TEST_SUITE_P(
     AllUnixDomainSockets, UnixSocketPairCmsgTest,
     ::testing::ValuesIn(IncludeReversals(GetSocketPairs())));
 
+INSTANTIATE_TEST_SUITE_P(
+    AllUnixDomainSockets, UnixSocketPeerCredTest,
+    ::testing::ValuesIn(IncludeReversals(GetSocketPairs())));
+
 }  // namespace
 }  // namespace testing
 }  // namespace gvisor
diff --git a/test/syscalls/linux/socket_unix_peercred.cc b/test/syscalls/linux/socket_unix_peercred.cc
diff --git a/test/syscalls/linux/socket_unix_peercred.h b/test/syscalls/linux/socket_unix_peercred.h
