x/sys/unix: UnixCredentials etc. missing on FreeBSD

[guelfey]

On Linux, the definitions to pass Unix credentials over sockets via SCM_CREDENTIALS like Ucred are exposed and there are helper functions like UnixCredentials to convert between raw and structured representations. FreeBSD has a similar capability via SCM_CREDS (see its unix manpage), which is not part of x/sys right now. This is not POSIX-standardized as far as I can tell.

At the minimum, we could include struct cmsgcred as part of the Go types (I'm happy to contribute here). Ideally we'd also add matching FreeBSD-implementations for UnixCredentials and ParseUnixCredentials, though signature and semantics would be slightly different (on FreeBSD, it's recommended to pass a zeroed buffer since the kernel apparently fills the fields, while on Linux the sender can explicitly set the fields as long as it has appropriate privileges).

[heschi]

cc @golang/runtime

[ianlancetaylor]

Can you write down what the API would look like on FreeBSD? Thanks.

[guelfey]

Something like:

// generated by godefs, example for amd64
type Cmsgcred struct {
       Pid     int32
       Uid     uint32
       Euid    uint32
       Gid     uint32
       Ngroups int16
       Groups  [16]uint32
}

const SizeofCmsgcred = // ...

func ParseUnixCredentials(scm *SocketControlMessage) (*Cmsgcred, error)

Typing it out now, I'd actually omit an equivalent of UnixCredentials. Since the user can't give explicit credentials and is supposed to just pass a zero buffer, It would just amount to make([]byte, SizeofCmsgcred which probably isn't worth its own function.

[ianlancetaylor]

Can we use the name Ucred rather than Cmsgcred so that we have the same API on FreeBSD and Linux? Or what would that be bad for some reason?

And if we do that it might be worth having UnixCredentials even if it doesn't do anything interesting. Then presumably the same code would work on FreeBSD and Linux which seems desirable if it is possible.

[guelfey]

It might be slightly misleading since on FreeBSD, the ucred name is used for a different struct (https://www.freebsd.org/cgi/man.cgi?query=ucred), though it's only for kernel-internal use. But I agree that having the same API is probably the best here; for the common case of only caring about Uid, Pid and Gid, the application code could be identical then for FreeBSD and Linux.