unixcreds: use euid instead of uid

[AkihiroSuda]

This commit also eliminates call for os/user.Current(),
which segfaults when glibc is statically linkedin.
(moby/moby#29478) (EDIT: the segfault issue is already handled in #13)

Signed-off-by: Akihiro Suda suda.akihiro@lab.ntt.co.jp

[stevvooe]

I've already patched the issue with #13.

What is the benefit of using euid over uid? The shim seems to have always used uid (really, just root).

[AkihiroSuda]

What is the benefit of using euid over uid? The shim seems to have always used uid (really, just root).

IIUC ttrpc can be used from other programs.

Also, rather than checking the credential by ourselves, shouldn't we use sendmsg(2) the ucred structure as a SCM_CREDENTIALS cmsg?

Example: https://github.com/lxc/cgmanager/blob/8f599b54c8021f37c1eeb7394a30b9e5fd0870f9/access_checks.c#L187

[stevvooe]

@AkihiroSuda I reproduced what was already in the shim in the 1.0 for months. The documentation on what is the correct thing to use here is thin, so I don't know.

[AkihiroSuda]

For example, when a suid bit is set to a ttrpc server program, the EUID of the program corresponds to the binary file owner.
In such a case, I expect EUID to be validated as the credential.

cc @estesp PTAL?

[crosbymichael]

LGTM

Although i don't think we need to change the function name for this change

[estesp]

Agree with @crosbymichael that the function name was fine; using euid definitely seems correct to cover the setuid case.

[mlaventure]

Likewise, no need to be too verbose with the name, the intent stays the same.

And agreed, EUID makes sense here

[AkihiroSuda]

reverted the function name

[AkihiroSuda]

test failure seems unrelated

--- FAIL: TestClientEOF (0.00s)
	server_test.go:326: accept unix @TestClientEOF: use of closed network connection

[AkihiroSuda]

restarted CI and now green

[stevvooe]

Move this description to UnixSocketRequireUidGid and point to it here instead.

[stevvooe]

@AkihiroSuda Needs another rebase.

[AkihiroSuda]

done

[stevvooe]

@AkihiroSuda Sigh. Again, pls. Sorry :(

[stevvooe]

LGTM