lkml.org 
[lkml]   [2021]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH 00/10] RFC: SO_PEERCRED for AF_VSOCK
Date
Hi,

This RFC aims to implement some support for SO_PEERCRED with AF_VSOCK,
so vsock servers & clients can lookup the basic peer credentials.
(further support for SO_PEERSEC could also be useful)

This is pretty straightforward for loopback transport, where both ends
are on the same host.

For vhost transport, the host will set the peer credentials associated with
the process who called VHOST_SET_OWNER (ex QEMU).

For virtio transport, the credentials are cleared upon connect, as
providing foreign credentials wouldn't make much sense.

I haven't looked at other transports. What do you think of this approach?

Note: I think it would be a better to set the peer credentials when we
actually can provide them, rather than at creation time, but I haven't
found a way yet. Help welcome!

Marc-André Lureau (10):
sock: move sock_init_peercred() from af_unix
sock: move sock_copy_peercred() from af_unix
vsock: owner field is specific to VMCI
sock: add sock_swap_peercred
virtio/vsock: add copy_peercred() to virtio_transport
vsock: set socket peercred
vsock/loopback: implement copy_peercred()
vhost/vsock: save owner pid & creds
vhost/vsock: implement copy_peercred
vsock/virtio: clear peer creds on connect

drivers/vhost/vsock.c | 46 +++++++++++++++++
include/linux/virtio_vsock.h | 2 +
include/net/af_vsock.h | 2 +
include/net/sock.h | 9 ++++
net/core/sock.c | 66 +++++++++++++++++++++++++
net/unix/af_unix.c | 50 ++-----------------
net/vmw_vsock/af_vsock.c | 8 +++
net/vmw_vsock/virtio_transport.c | 22 ++++++++-
net/vmw_vsock/virtio_transport_common.c | 9 ++++
net/vmw_vsock/vsock_loopback.c | 7 +++
10 files changed, 175 insertions(+), 46 deletions(-)


base-commit: e0bfcf9c77d9b2c11d2767f0c747f7721ae0cc51
--
2.33.0.721.g106298f7f9

\
 
 \ /
  Last update: 2021-10-21 14:38    [W:0.228 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site