[PATCH net-next 2/3] net: add SO_PASSCRED_THREAD to get a thread-specific SCM_CREDENTIALS
From: Andrew Halaney
Date: Mon Nov 02 2026 - 18:14:54 EST
Currently, SCM_CREDENTIALS carries the pid of the thread-group leader,
despite carrying the uid/gid of the actual sending thread.
SO_PASSPIDFD_THREAD lets a receiver identify the sending thread, but
only through a pidfd. If you just want to know what the tid of the
sending thread is you have to do something like:
1. Setup SO_PASSPIDFD_THREAD on the socket
2. ioctl(thread_pidfd, PIDFD_GET_INFO) per message
3. close(thread_pidfd) per message
For example systemd-journald wants to log the tid as "trusted field"
(aka provided by the kernel) but doesn't have a great way to do so
right now, unlike the options for uid/gid/pid which are covered by
SO_PASSCRED currently.
So add SO_PASSCRED_THREAD as a sibling of SO_PASSCRED. It delivers
SCM_CREDENTIALS_THREAD whose ucred carries the tid of the sending
thread instead of the thread-group leader. This is completely
independent of SO_PASSCRED, so a receiver can ask for both. Use
a new cmsg rather than changing SCM_CREDENTIALS because users
expect ucred.pid in that context to be the thread-group leader.
As with SO_PASSPIDFD_THREAD, recvmsg() on SOCK_STREAM sockets stops
merging data at a thread boundary once SO_PASSCRED_THREAD is set.
Signed-off-by: Andrew Halaney <andrew@xxxxxxxxxxxx>
---
arch/alpha/include/uapi/asm/socket.h | 2 ++
arch/mips/include/uapi/asm/socket.h | 2 ++
arch/parisc/include/uapi/asm/socket.h | 2 ++
arch/sparc/include/uapi/asm/socket.h | 2 ++
include/linux/socket.h | 1 +
include/net/sock.h | 4 +++-
include/uapi/asm-generic/socket.h | 2 ++
net/core/scm.c | 32 +++++++++++++++++++++-----------
net/core/sock.c | 14 ++++++++++++++
net/unix/af_unix.c | 6 +++---
10 files changed, 52 insertions(+), 15 deletions(-)
diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
index 5d3524c26b2b..430ef65e51ea 100644
--- a/arch/alpha/include/uapi/asm/socket.h
+++ b/arch/alpha/include/uapi/asm/socket.h
@@ -161,6 +161,8 @@
#define SO_PEERPIDFD_THREAD 87
+#define SO_PASSCRED_THREAD 88
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
index 245a43f52fb1..7e49b24170d2 100644
--- a/arch/mips/include/uapi/asm/socket.h
+++ b/arch/mips/include/uapi/asm/socket.h
@@ -172,6 +172,8 @@
#define SO_PEERPIDFD_THREAD 87
+#define SO_PASSCRED_THREAD 88
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index f23710e1c671..e414c2397224 100644
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h
@@ -153,6 +153,8 @@
#define SO_PEERPIDFD_THREAD 0x4055
+#define SO_PASSCRED_THREAD 0x4056
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64
diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
index b35b25bdefc2..9ca7ec9ba450 100644
--- a/arch/sparc/include/uapi/asm/socket.h
+++ b/arch/sparc/include/uapi/asm/socket.h
@@ -154,6 +154,8 @@
#define SO_PEERPIDFD_THREAD 0x0060
+#define SO_PASSCRED_THREAD 0x0061
+
#if !defined(__KERNEL__)
diff --git a/include/linux/socket.h b/include/linux/socket.h
index b17fdb7d38a7..37ddcdfc0377 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -194,6 +194,7 @@ static inline size_t msg_data_left(const struct msghdr *msg)
#define SCM_SECURITY 0x03 /* rw: security label */
#define SCM_PIDFD 0x04 /* ro: pidfd (int) */
#define SCM_PIDFD_THREAD 0x05 /* ro: thread pidfd (int) */
+#define SCM_CREDENTIALS_THREAD 0x06 /* ro: struct ucred, thread */
struct ucred {
__u32 pid;
diff --git a/include/net/sock.h b/include/net/sock.h
index 173b37b2b8bb..344057d3aa74 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -357,6 +357,7 @@ struct sk_filter;
* @sk_scm_pidfd: flagged by SO_PASSPIDFD to recv SCM_PIDFD
* @sk_scm_rights: flagged by SO_PASSRIGHTS to recv SCM_RIGHTS
* @sk_scm_pidfd_thread: flagged by SO_PASSPIDFD_THREAD to recv a thread SCM_PIDFD
+ * @sk_scm_credentials_thread: flagged by SO_PASSCRED_THREAD to recv SCM_CREDENTIALS_THREAD
* @sk_scm_unused: unused flags for scm_recv()
* @ns_tracker: tracker for netns reference
* @sk_user_frags: xarray of pages the user is holding a reference on.
@@ -564,7 +565,8 @@ struct sock {
sk_scm_pidfd : 1,
sk_scm_rights : 1,
sk_scm_pidfd_thread : 1,
- sk_scm_unused : 3;
+ sk_scm_credentials_thread : 1,
+ sk_scm_unused : 2;
};
};
u8 sk_clockid;
diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index 56fed7ab27ab..2e5d9db1c9fa 100644
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -156,6 +156,8 @@
#define SO_PEERPIDFD_THREAD 87
+#define SO_PASSCRED_THREAD 88
+
#if !defined(__KERNEL__)
#if __BITS_PER_LONG == 64 || (defined(__x86_64__) && defined(__ILP32__))
diff --git a/net/core/scm.c b/net/core/scm.c
index ae38f3c1165c..d0d453fb811d 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -543,28 +543,34 @@ static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm,
fd_install(pidfd, pidfd_file);
}
+static void scm_creds_recv(struct msghdr *msg, struct scm_cookie *scm,
+ u32 pid, int cmsg_type)
+{
+ struct user_namespace *current_ns = current_user_ns();
+ struct ucred ucreds = {
+ .pid = pid,
+ .uid = from_kuid_munged(current_ns, scm->creds.uid),
+ .gid = from_kgid_munged(current_ns, scm->creds.gid),
+ };
+
+ put_cmsg(msg, SOL_SOCKET, cmsg_type, sizeof(ucreds), &ucreds);
+}
+
static bool __scm_recv_common(struct sock *sk, struct msghdr *msg,
struct scm_cookie *scm, int flags)
{
if (!msg->msg_control) {
if (sk->sk_scm_credentials || sk->sk_scm_pidfd ||
- sk->sk_scm_pidfd_thread || scm->fp || scm_has_secdata(sk))
+ sk->sk_scm_pidfd_thread || sk->sk_scm_credentials_thread ||
+ scm->fp || scm_has_secdata(sk))
msg->msg_flags |= MSG_CTRUNC;
scm_destroy(scm);
return false;
}
- if (sk->sk_scm_credentials) {
- struct user_namespace *current_ns = current_user_ns();
- struct ucred ucreds = {
- .pid = scm->creds.pid,
- .uid = from_kuid_munged(current_ns, scm->creds.uid),
- .gid = from_kgid_munged(current_ns, scm->creds.gid),
- };
-
- put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds);
- }
+ if (sk->sk_scm_credentials)
+ scm_creds_recv(msg, scm, scm->creds.pid, SCM_CREDENTIALS);
scm_passec(sk, msg, scm);
@@ -587,6 +593,10 @@ void scm_recv_unix(struct socket *sock, struct msghdr *msg,
if (!__scm_recv_common(sock->sk, msg, scm, flags))
return;
+ if (sock->sk->sk_scm_credentials_thread)
+ scm_creds_recv(msg, scm, pid_vnr(scm->pid[PIDTYPE_PID]),
+ SCM_CREDENTIALS_THREAD);
+
if (scm->fp) {
struct unix_sock *u;
diff --git a/net/core/sock.c b/net/core/sock.c
index e7405be8941f..6b443bd44581 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1586,6 +1586,13 @@ int sk_setsockopt(struct sock *sk, int level, int optname,
ret = -EOPNOTSUPP;
break;
+ case SO_PASSCRED_THREAD:
+ if (sk_is_unix(sk))
+ sk->sk_scm_credentials_thread = valbool;
+ else
+ ret = -EOPNOTSUPP;
+ break;
+
case SO_PASSRIGHTS:
if (sk_is_unix(sk))
sk->sk_scm_rights = valbool;
@@ -1952,6 +1959,13 @@ int sk_getsockopt(struct sock *sk, int level, int optname,
v.val = sk->sk_scm_pidfd_thread;
break;
+ case SO_PASSCRED_THREAD:
+ if (!sk_is_unix(sk))
+ return -EOPNOTSUPP;
+
+ v.val = sk->sk_scm_credentials_thread;
+ break;
+
case SO_PASSRIGHTS:
if (!sk_is_unix(sk))
return -EOPNOTSUPP;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 98fcfd7301f6..d802463cec45 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -800,7 +800,7 @@ static void copy_peercred(struct sock *sk, struct sock *peersk)
static bool unix_may_passcred(const struct sock *sk)
{
return sk->sk_scm_credentials || sk->sk_scm_pidfd ||
- sk->sk_scm_pidfd_thread;
+ sk->sk_scm_pidfd_thread || sk->sk_scm_credentials_thread;
}
static int unix_listen(struct socket *sock, int backlog)
@@ -2047,8 +2047,8 @@ static int unix_maybe_add_creds(struct sk_buff *skb, const struct sock *sk,
static bool unix_skb_scm_eq(const struct sock *sk, struct sk_buff *skb,
struct scm_cookie *scm)
{
- /* Only a thread pidfd receiver can tell threads of one process apart. */
- if (sk->sk_scm_pidfd_thread &&
+ /* Only a thread-aware receiver can tell threads of one process apart. */
+ if ((sk->sk_scm_pidfd_thread || sk->sk_scm_credentials_thread) &&
UNIXCB(skb).pid[PIDTYPE_PID] != scm->pid[PIDTYPE_PID])
return false;
--
2.56.0