Bug 104657 - Expose group list from SO_PEERGROUPS in GetConnectionCredentials()
Summary: Expose group list from SO_PEERGROUPS in GetConnectionCredentials()
Alias: None
Product: dbus
Classification: Unclassified
Component: core (show other bugs)
Version: git master
Hardware: Other All
: low enhancement
Assignee: D-Bus Maintainers
QA Contact: D-Bus Maintainers
Depends on: 103737
  Show dependency treegraph
Reported: 2018-01-16 14:10 UTC by Simon McVittie
Modified: 2018-10-12 21:32 UTC (History)
3 users (show)

See Also:
i915 platform:
i915 features:


Description Simon McVittie 2018-01-16 14:10:00 UTC
+++ This bug was initially created as a clone of Bug #103737 +++

Recent Linux kernels (4.13+) allow for getting a list of auxiliary groups of a socket peer in a race-free way using the SO_PEERGROUPS getsockopt option. Bug #103737 tracks the use of that option in dbus.

If anyone (maybe polkit?) cares about this information, we could add UnixGroupIDs (ARRAY of UINT32) to GetConnectionCredentials().

If we do, then I think its semantics should be that this field is only present when we can discover the other process' complete list of groups, such as on Linux 4.13+ with SO_PEERGROUPS. On platforms where we can only find the primary group ID (like older Linux with SO_PEERCRED) I don't think we should expose any group information at all, because that's needlessly confusing.

I also don't think the bus API should expose the group list that we get from getgrouplist(), to give callers that care about it a way to distinguish between true facts ("the peer definitely had exactly these groups at the time the connection was established") and conjecture ("the peer has uid 1000 so we think it probably has all the groups that uid 1000 would have if they logged in"). If the caller wants to use the same best-guess via getgrouplist() that older/non-Linux dbus-daemon does, then they can implement that themselves.
Comment 1 GitLab Migration User 2018-10-12 21:32:35 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/dbus/dbus/issues/196.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.