Re: [PATCH v3 03/10] net: add SO_PASSPIDFD_THREAD to get a thread-specific SCM_PIDFD

[Kuniyuki Iwashima]

On Mon, Sep 28, 2026 at 2:27 AM Andrew Halaney <andrew@xxxxxxxxxxxx> wrote:
>
> From: Christian Brauner <brauner@xxxxxxxxxx>
>
> Currently, SCM_PIDFD carries a pidfd for the thread-group leader. A
> broker or the coredump server cannot learn the identity of the specific
> thread that sent a given message. Now that both struct pids are recorded
> a receiver can ask for the specific identity it needs.
>
> So add SO_PASSPIDFD_THREAD as a sibling of SO_PASSPIDFD.
> SO_PASSPIDFD_THREAD delivers an SCM_PIDFD_THREAD, i.e. scoped
> to the specific thread sending. This is completely independent of
> SO_PASSPIDFD, meaning you can use both options and get both cmsgs.
>
> On SOCK_STREAM sockets recvmsg() only stops merging data at a thread
> boundary when the receiver asked for a thread pidfd. For SO_PASSCRED and
> SO_PASSPIDFD receivers all threads of one process remain a single
> writer.
>
> Signed-off-by: Christian Brauner (Amutable) <brauner@xxxxxxxxxx>
> Co-developed-by: Andrew Halaney <andrew@xxxxxxxxxxxx>
> Signed-off-by: Andrew Halaney <andrew@xxxxxxxxxxxx>
> ---
>  arch/alpha/include/uapi/asm/socket.h  |  2 ++
>  arch/mips/include/uapi/asm/socket.h   |  2 ++
>  arch/parisc/include/uapi/asm/socket.h |  2 ++
>  arch/sparc/include/uapi/asm/socket.h  |  2 ++
>  include/linux/socket.h                |  9 +++++----
>  include/net/sock.h                    | 14 +++++++++++++-
>  include/uapi/asm-generic/socket.h     |  2 ++
>  net/core/scm.c                        | 27 +++++++++++++++++++--------
>  net/core/sock.c                       | 14 ++++++++++++++
>  net/unix/af_unix.c                    | 12 +++++++++---
>  10 files changed, 70 insertions(+), 16 deletions(-)
>
> diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
> index 946a5fad2691..bb3d534826bb 100644
> --- a/arch/alpha/include/uapi/asm/socket.h
> +++ b/arch/alpha/include/uapi/asm/socket.h
> @@ -157,6 +157,8 @@
>
>  #define SO_RIGHTS_NOTRUNC      85
>
> +#define SO_PASSPIDFD_THREAD    86
> +
>  #if !defined(__KERNEL__)
>
>  #if __BITS_PER_LONG == 64
> diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
> index f1641dde135f..269badcaa086 100644
> --- a/arch/mips/include/uapi/asm/socket.h
> +++ b/arch/mips/include/uapi/asm/socket.h
> @@ -168,6 +168,8 @@
>
>  #define SO_RIGHTS_NOTRUNC      85
>
> +#define SO_PASSPIDFD_THREAD    86
> +
>  #if !defined(__KERNEL__)
>
>  #if __BITS_PER_LONG == 64
> diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
> index f3a3815c7dc2..313aee10a52c 100644
> --- a/arch/parisc/include/uapi/asm/socket.h
> +++ b/arch/parisc/include/uapi/asm/socket.h
> @@ -149,6 +149,8 @@
>
>  #define SO_RIGHTS_NOTRUNC      0x4053
>
> +#define SO_PASSPIDFD_THREAD    0x4054
> +
>  #if !defined(__KERNEL__)
>
>  #if __BITS_PER_LONG == 64
> diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
> index 7907f3b1f0ee..bd3e69bcce7a 100644
> --- a/arch/sparc/include/uapi/asm/socket.h
> +++ b/arch/sparc/include/uapi/asm/socket.h
> @@ -150,6 +150,8 @@
>
>  #define SO_RIGHTS_NOTRUNC        0x005e
>
> +#define SO_PASSPIDFD_THREAD      0x005f
> +
>  #if !defined(__KERNEL__)
>
>
> diff --git a/include/linux/socket.h b/include/linux/socket.h
> index 5a5eb1250103..b17fdb7d38a7 100644
> --- a/include/linux/socket.h
> +++ b/include/linux/socket.h
> @@ -189,10 +189,11 @@ static inline size_t msg_data_left(const struct msghdr *msg)
>
>  /* "Socket"-level control message types: */
>
> -#define        SCM_RIGHTS      0x01            /* rw: access rights (array of int) */
> -#define SCM_CREDENTIALS 0x02           /* rw: struct ucred             */
> -#define SCM_SECURITY   0x03            /* rw: security label           */
> -#define SCM_PIDFD      0x04            /* ro: pidfd (int)              */
> +#define        SCM_RIGHTS              0x01    /* rw: access rights (array of int) */
> +#define SCM_CREDENTIALS                0x02    /* rw: struct ucred             */
> +#define SCM_SECURITY           0x03    /* rw: security label           */
> +#define SCM_PIDFD              0x04    /* ro: pidfd (int)              */
> +#define SCM_PIDFD_THREAD       0x05    /* ro: thread pidfd (int)       */
>
>  struct ucred {
>         __u32   pid;
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 60ea55dc1885..14df0fb68259 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -356,6 +356,7 @@ struct sk_filter;
>    *    @sk_scm_security: flagged by SO_PASSSEC to recv SCM_SECURITY
>    *    @sk_scm_pidfd: flagged by SO_PASSPIDFD to recv SCM_PIDFD
>    *    @sk_scm_rights: flagged by SO_PASSRIGHTS to recv SCM_RIGHTS
> +  *    @sk_scm_pidfd_thread: flagged by SO_PASSPIDFD_THREAD to recv a thread SCM_PIDFD
>    *    @sk_scm_unused: unused flags for scm_recv()
>    *    @ns_tracker: tracker for netns reference
>    *    @sk_user_frags: xarray of pages the user is holding a reference on.
> @@ -562,7 +563,8 @@ struct sock {
>                                 sk_scm_security : 1,
>                                 sk_scm_pidfd : 1,
>                                 sk_scm_rights : 1,
> -                               sk_scm_unused : 4;
> +                               sk_scm_pidfd_thread : 1,
> +                               sk_scm_unused : 3;
>                 };
>         };
>         u8                      sk_clockid;
> @@ -2988,6 +2990,16 @@ static inline bool sk_is_stream_unix(const struct sock *sk)
>         return sk_is_unix(sk) && sk->sk_type == SOCK_STREAM;
>  }
>
> +static inline bool sk_scm_pidfd_wanted(const struct sock *sk)
> +{
> +       return sk->sk_scm_pidfd;
> +}
> +
> +static inline bool sk_scm_pidfd_thread_wanted(const struct sock *sk)
> +{
> +       return sk->sk_scm_pidfd_thread;
> +}

nit: remove these helpers and use the values directly.

Unlike scm_has_secdata(), the fields do not depend on any config.


> +
>  static inline bool sk_is_vsock(const struct sock *sk)
>  {
>         return sk->sk_family == AF_VSOCK;
> diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
> index 84ea7b92936e..d1e5c6de146d 100644
> --- a/include/uapi/asm-generic/socket.h
> +++ b/include/uapi/asm-generic/socket.h
> @@ -152,6 +152,8 @@
>
>  #define SO_RIGHTS_NOTRUNC      85
>
> +#define SO_PASSPIDFD_THREAD    86
> +
>  #if !defined(__KERNEL__)
>
>  #if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))
> diff --git a/net/core/scm.c b/net/core/scm.c
> index 9b9e119c353a..ba43d76027af 100644
> --- a/net/core/scm.c
> +++ b/net/core/scm.c
> @@ -499,11 +499,16 @@ static bool scm_has_secdata(struct sock *sk)
>  }
>  #endif
>
> -static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm)
> +static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm,
> +                          enum pid_type type, int cmsg_type)
>  {
> +       unsigned int flags = PIDFD_STALE;
>         struct file *pidfd_file = NULL;
> +       struct pid *pid;
>         int len, pidfd;
>
> +       pid = scm->pid[type];
> +
>         /* put_cmsg() doesn't return an error if CMSG is truncated,
>          * that's why we need to opencode these checks here.
>          */
> @@ -517,12 +522,15 @@ static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm)
>                 return;
>         }
>
> -       if (!scm->pid[PIDTYPE_TGID])
> +       if (!pid)
>                 return;
>
> -       pidfd = pidfd_prepare(scm->pid[PIDTYPE_TGID], PIDFD_STALE, &pidfd_file);
> +       if (type == PIDTYPE_PID)
> +               flags |= PIDFD_THREAD;
>
> -       if (put_cmsg(msg, SOL_SOCKET, SCM_PIDFD, sizeof(int), &pidfd)) {
> +       pidfd = pidfd_prepare(pid, flags, &pidfd_file);
> +
> +       if (put_cmsg(msg, SOL_SOCKET, cmsg_type, sizeof(int), &pidfd)) {
>                 if (pidfd_file) {
>                         put_unused_fd(pidfd);
>                         fput(pidfd_file);
> @@ -539,8 +547,8 @@ static bool __scm_recv_common(struct sock *sk, struct msghdr *msg,
>                               struct scm_cookie *scm, int flags)
>  {
>         if (!msg->msg_control) {
> -               if (sk->sk_scm_credentials || sk->sk_scm_pidfd ||
> -                   scm->fp || scm_has_secdata(sk))
> +               if (sk->sk_scm_credentials || sk_scm_pidfd_wanted(sk) ||
> +                   sk_scm_pidfd_thread_wanted(sk) || scm->fp || scm_has_secdata(sk))
>                         msg->msg_flags |= MSG_CTRUNC;
>
>                 scm_destroy(scm);
> @@ -586,8 +594,11 @@ void scm_recv_unix(struct socket *sock, struct msghdr *msg,
>                 scm_detach_fds(msg, scm, READ_ONCE(u->scm_rights_notrunc));
>         }
>
> -       if (sock->sk->sk_scm_pidfd)
> -               scm_pidfd_recv(msg, scm);
> +       if (sk_scm_pidfd_wanted(sock->sk))
> +               scm_pidfd_recv(msg, scm, PIDTYPE_TGID, SCM_PIDFD);
> +
> +       if (sk_scm_pidfd_thread_wanted(sock->sk))
> +               scm_pidfd_recv(msg, scm, PIDTYPE_PID, SCM_PIDFD_THREAD);
>
>         scm_destroy_cred(scm);
>  }
> diff --git a/net/core/sock.c b/net/core/sock.c
> index d23333bb4f3f..3b5f28573752 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -1578,6 +1578,13 @@ int sk_setsockopt(struct sock *sk, int level, int optname,
>                         ret = -EOPNOTSUPP;
>                 break;
>
> +       case SO_PASSPIDFD_THREAD:
> +               if (sk_is_unix(sk))
> +                       sk->sk_scm_pidfd_thread = valbool;
> +               else
> +                       ret = -EOPNOTSUPP;
> +               break;
> +
>         case SO_PASSRIGHTS:
>                 if (sk_is_unix(sk))
>                         sk->sk_scm_rights = valbool;
> @@ -1893,6 +1900,13 @@ int sk_getsockopt(struct sock *sk, int level, int optname,
>                 v.val = sk->sk_scm_pidfd;
>                 break;
>
> +       case SO_PASSPIDFD_THREAD:
> +               if (!sk_is_unix(sk))
> +                       return -EOPNOTSUPP;
> +
> +               v.val = sk->sk_scm_pidfd_thread;
> +               break;
> +
>         case SO_PASSRIGHTS:
>                 if (!sk_is_unix(sk))
>                         return -EOPNOTSUPP;
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index c7d423465859..6cc2873d9a4f 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -803,7 +803,8 @@ static void copy_peercred(struct sock *sk, struct sock *peersk)
>
>  static bool unix_may_passcred(const struct sock *sk)
>  {
> -       return sk->sk_scm_credentials || sk->sk_scm_pidfd;
> +       return sk->sk_scm_credentials || sk_scm_pidfd_wanted(sk) ||
> +               sk_scm_pidfd_thread_wanted(sk);
>  }
>
>  static int unix_listen(struct socket *sock, int backlog)
> @@ -2048,9 +2049,14 @@ static int unix_maybe_add_creds(struct sk_buff *skb, const struct sock *sk,
>         return 0;
>  }
>
> -static bool unix_skb_scm_eq(struct sk_buff *skb,
> +static bool unix_skb_scm_eq(const struct sock *sk, struct sk_buff *skb,
>                             struct scm_cookie *scm)
>  {
> +       /* Only a thread pidfd receiver can tell threads of one process apart. */
> +       if (sk->sk_scm_pidfd_thread &&
> +           UNIXCB(skb).pid[PIDTYPE_PID] != scm->pid[PIDTYPE_PID])
> +               return false;
> +
>         return UNIXCB(skb).pid[PIDTYPE_TGID] == scm->pid[PIDTYPE_TGID] &&
>                uid_eq(UNIXCB(skb).uid, scm->creds.uid) &&
>                gid_eq(UNIXCB(skb).gid, scm->creds.gid) &&
> @@ -3033,7 +3039,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
>
>                 if (check_creds) {
>                         /* Never glue messages from different writers */
> -                       if (!unix_skb_scm_eq(skb, &scm))
> +                       if (!unix_skb_scm_eq(sk, skb, &scm))
>                                 break;
>                 } else if (unix_may_passcred(sk)) {
>                         /* Copy credentials */
>
> --
> 2.55.0
>