Family: Cred
Authors: C Stephen Gunn, KSB Braunsdorf
Mail: [email protected], [email protected]
Version: 6.1
Bugs: None known.

Introduction

Modern UNIX operating systems allow passing a secure description of a processes credentials (viz. uid, gid, and pid data) to another, perhaps unrelated, process via a UNIX domain socket pair. This module presents a portable abstraction to send and receive these messages.

Configuration

#define HOSTTYPE
#define HOSTOS: Define SUN5, HPUX11, FREEBSD, LINUX, IBMR2, or some other OS name. Also define the "base 100" release of the OS, for example SunOS 5.10.0 is "51000", the result of ((5*100)+10)*100)+0.
#define HAVE_STRERROR: Defined to be 1 if the local system include files define strerror(3).
#define CRED_TOKEN "short-string": Optionally the implementor may define a token to assure that the same version of the abstraction is on both sides of the protocol. The default is a 4 character alpha-numeric string. This is intended to prevent incompatible versions from corruption of exchanges (nothing more).

Synopsis

include <sys/types.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <errno.h>

#include "machine.h"
#include "cred.h"

Description

This modules is used to present credentials to the acld access control deamon.

Provides

extern int SendCred(int fd);

Send our credentials a peer process.

The peer process should be calling RecvCred on the other end of fd.

This is exploded under -u send.

#define CRED_TYPE ...

This is defined in "cred.h" for use in any application that uses the interface. It depends on sys/socket.h to define either SCM_CREDENTIALS or SCM_CREDS. This set which of (struct ucred) or (struct cmsgcred) is sent by the kernel.

extern int RecvCred(int fd, CRED_TYPE *pCred);

Waits for a peer process to send her credentials on file descriptor fd. The credentials presented (by the kernel) are copied into the buffer provided.

See /usr/include/sys/socket.h for the definition of CRED_TYPE (on most systems).

This is exploded under -u recv.

extern void DumpCred(CRED_TYPE *pCred);

Output a (CRED_TYPE) in a easy to read format. This is exploded under -u dump.

EXAMPLE

See the test driver embedded in the module, via:

explode -s cred.h
explode -u test cred.c
more credtest.c

Diagnostics

None.

Todo List

In the test driver we do not check all the groups in the grouplist.

$Id: cred.html,v 1.9 2012/03/21 16:15:04 ksb Exp $