pg.ddx.io  pgsql-patches@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Garick Hamlin <ghamlin@isc.upenn.edu>
To: pgsql-hackers@postgresql.org
To: pgsql-patches@postgresql.org
Subject: Solaris ident authentication using unix domain sockets
Date: Thu, 3 Jul 2008 13:36:28 -0400
Message-ID: <20080703173628.GA1697@isc.upenn.edu> (raw)
In-Reply-To: <20080703165936.E80B312A5FFF@mx2.hub.org>
References: <20080703165936.E80B312A5FFF@mx2.hub.org>

Hi,
	I have a patch that I have been using to support postgresql's
notion of ident authentication when using unix domain sockets on
Solaris.  This patch basically just adds support for using 
getupeercred() on Solaris so unix sockets and ident auth works just
like it does on Linux and elsewhere.

	This was my first attempt wrestling with automake.  I've 
tested it builds properly after it is applied and autoreconf is run
on RHEL4/Linux/x86.  I am using the patch currently on Solaris 10 / 
x86.

Garick


inline patch 1: postgresql/configure.in, postgresql/src/backend/libpq/hba.c (+35/-1 lines) download inline-1.patchdiff -cr postgresql_CVS/configure.in postgresql/configure.in
*** postgresql_CVS/configure.in	Tue Jun 24 15:52:30 2008
--- postgresql/configure.in	Tue Jun 24 15:57:22 2008
***************
*** 1095,1101 ****
  AC_FUNC_ACCEPT_ARGTYPES
  PGAC_FUNC_GETTIMEOFDAY_1ARG
  
! AC_CHECK_FUNCS([cbrt dlopen fcvt fdatasync getpeereid getrlimit memmove poll pstat readlink setproctitle setsid sigprocmask symlink sysconf towlower utime utimes waitpid wcstombs])
  
  AC_CHECK_DECLS(fdatasync, [], [], [#include <unistd.h>])
  AC_CHECK_DECLS(posix_fadvise, [], [], [#include <fcntl.h>])
--- 1095,1101 ----
  AC_FUNC_ACCEPT_ARGTYPES
  PGAC_FUNC_GETTIMEOFDAY_1ARG
  
! AC_CHECK_FUNCS([getpeerucred cbrt dlopen fcvt fdatasync getpeereid getrlimit memmove poll pstat readlink setproctitle setsid sigprocmask symlink sysconf towlower utime utimes waitpid wcstombs])
  
  AC_CHECK_DECLS(fdatasync, [], [], [#include <unistd.h>])
  AC_CHECK_DECLS(posix_fadvise, [], [], [#include <fcntl.h>])
diff -cr postgresql_CVS/src/backend/libpq/hba.c postgresql/src/backend/libpq/hba.c
*** postgresql_CVS/src/backend/libpq/hba.c	Tue Jun 24 15:52:32 2008
--- postgresql/src/backend/libpq/hba.c	Tue Jun 24 15:53:00 2008
***************
*** 25,30 ****
--- 25,33 ----
  #include <sys/uio.h>
  #include <sys/ucred.h>
  #endif
+ #if defined(HAVE_GETPEERUCRED) 
+ #include <ucred.h>
+ #endif
  #include <netinet/in.h>
  #include <arpa/inet.h>
  #include <unistd.h>
***************
*** 1500,1505 ****
--- 1503,1539 ----
  	strlcpy(ident_user, pass->pw_name, IDENT_USERNAME_MAX + 1);
  
  	return true;
+ #elif defined(HAVE_GETPEERUCRED) /* Solaris > 10 */
+ 	uid_t		uid;
+ 	gid_t		gid;
+ 	struct passwd 	*pass;
+ 	int 		ucred_ok=1;
+ 	ucred_t *ucred = NULL;
+ 	if (getpeerucred(sock, &ucred) == -1)
+ 		ucred_ok = 0;
+ 	if (ucred_ok && (uid = ucred_geteuid(ucred)) == -1 )
+ 		ucred_ok = 0;
+ 	if (ucred_ok && (gid = ucred_getrgid(ucred)) == -1 )
+ 		ucred_ok = 0;
+ 	if (ucred)
+ 		ucred_free(ucred);
+ 	if (!ucred_ok) {
+ 		/* We didn't get a valid credentials struct. */
+ 		ereport(LOG, (
+ 			 "could not get peer credentials: %s",
+ 				strerror(errno)));
+ 		return false;
+ 	}
+ 	pass = getpwuid(uid);
+ 	if (pass == NULL)
+ 	{
+ 		ereport(LOG,
+ 			(errmsg("local user with ID %d does not exist",
+ 					(int) uid)));
+ 		return false;
+ 	}
+ 	strlcpy(ident_user, pass->pw_name, IDENT_USERNAME_MAX + 1);
+ 	return true;
  #elif defined(HAVE_STRUCT_CMSGCRED) || defined(HAVE_STRUCT_FCRED) || (defined(HAVE_STRUCT_SOCKCRED) && defined(LOCAL_CREDS))
  	struct msghdr msg;
  

view thread (12+ messages)  latest in thread

Message-ID: <20080703173628.GA1697@isc.upenn.edu>
Permalink:  ../20080703173628.GA1697@isc.upenn.edu/
Also on:    postgresql.org/message-id/20080703173628.GA1697@isc.upenn.edu

 ·  · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-patches@postgresql.org
  Cc: ghamlin@isc.upenn.edu, pgsql-hackers@postgresql.org
  Subject: Re: Solaris ident authentication using unix domain sockets
  In-Reply-To: <20080703173628.GA1697@isc.upenn.edu>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox