Ident authentication over Unix-domain sockets on Solaris, using

getpeerucred() function.

Author: Garick Hamlin <ghamlin@isc.upenn.edu>

diff --git a/configure b/configure
index 37af429c0f6140577d3a64a7395cbd00dd51c269..eb88c4e76e66505d4e89c2b1550ae7825fed81f4 100755 (executable)
--- a/configure
+++ b/configure
@@ -8925,7 +8925,8 @@ done
 
 
 
-for ac_header in crypt.h dld.h fp_class.h getopt.h ieeefp.h langinfo.h poll.h pwd.h sys/ipc.h sys/poll.h sys/pstat.h sys/resource.h sys/select.h sys/sem.h sys/socket.h sys/shm.h sys/tas.h sys/time.h sys/un.h termios.h utime.h wchar.h wctype.h kernel/OS.h kernel/image.h SupportDefs.h
+
+for ac_header in crypt.h dld.h fp_class.h getopt.h ieeefp.h langinfo.h poll.h pwd.h sys/ipc.h sys/poll.h sys/pstat.h sys/resource.h sys/select.h sys/sem.h sys/socket.h sys/shm.h sys/tas.h sys/time.h sys/un.h termios.h ucred.h utime.h wchar.h wctype.h kernel/OS.h kernel/image.h SupportDefs.h
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
 if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
@@ -15804,7 +15805,8 @@ fi
 
 
 
-for ac_func in cbrt dlopen fcvt fdatasync getpeereid getrlimit memmove poll pstat readlink setproctitle setsid sigprocmask symlink sysconf towlower utime utimes waitpid wcstombs
+
+for ac_func in cbrt dlopen fcvt fdatasync getpeereid getpeerucred getrlimit memmove poll pstat readlink setproctitle setsid sigprocmask symlink sysconf towlower utime utimes waitpid wcstombs
 do
 as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
 { echo "$as_me:$LINENO: checking for $ac_func" >&5

diff --git a/configure.in b/configure.in
index 8bda0dba5c46ec941fe070b9bfde6bc9e3519f90..9f5069e4f7cddff9ae60375c4b16d6b639c914e7 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -955,7 +955,7 @@ AC_SUBST(OSSP_UUID_LIBS)
 ##
 
 dnl sys/socket.h is required by AC_FUNC_ACCEPT_ARGTYPES
-AC_CHECK_HEADERS([crypt.h dld.h fp_class.h getopt.h ieeefp.h langinfo.h poll.h pwd.h sys/ipc.h sys/poll.h sys/pstat.h sys/resource.h sys/select.h sys/sem.h sys/socket.h sys/shm.h sys/tas.h sys/time.h sys/un.h termios.h utime.h wchar.h wctype.h kernel/OS.h kernel/image.h SupportDefs.h])
+AC_CHECK_HEADERS([crypt.h dld.h fp_class.h getopt.h ieeefp.h langinfo.h poll.h pwd.h sys/ipc.h sys/poll.h sys/pstat.h sys/resource.h sys/select.h sys/sem.h sys/socket.h sys/shm.h sys/tas.h sys/time.h sys/un.h termios.h ucred.h utime.h wchar.h wctype.h kernel/OS.h kernel/image.h SupportDefs.h])
 
 # At least on IRIX, cpp test for netinet/tcp.h will fail unless
 # netinet/in.h is included first.
@@ -1134,7 +1134,7 @@ PGAC_VAR_INT_TIMEZONE
 AC_FUNC_ACCEPT_ARGTYPES
 PGAC_FUNC_GETTIMEOFDAY_1ARG
 
-AC_CHECK_FUNCS([cbrt dlopen fcvt fdatasync getpeereid getrlimit memmove poll pstat readlink setproctitle setsid sigprocmask symlink sysconf towlower utime utimes waitpid wcstombs])
+AC_CHECK_FUNCS([cbrt dlopen fcvt fdatasync getpeereid getpeerucred getrlimit memmove poll pstat readlink setproctitle setsid sigprocmask symlink sysconf towlower utime utimes waitpid wcstombs])
 
 AC_CHECK_DECLS(fdatasync, [], [], [#include <unistd.h>])
 AC_CHECK_DECLS(posix_fadvise, [], [], [#include <fcntl.h>])

diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index 733b6bafd893129d1f483b6e9efa7527acf3519c..3351744611142cd5fc514df938c076d1f2ca344e 100644 (file)
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -1005,7 +1005,7 @@ omicron       bryanh            guest1
     Unix-domain sockets (currently <systemitem
     class="osname">Linux</>, <systemitem class="osname">FreeBSD</>,
     <systemitem class="osname">NetBSD</>, <systemitem class="osname">OpenBSD</>, 
-    and <systemitem class="osname">BSD/OS</>), ident authentication can also 
+    <systemitem class="osname">BSD/OS</>, and <systemitem class="osname">Solaris</systemitem>), ident authentication can also 
     be applied to local connections. In this case, no security risk is added by
     using ident authentication; indeed it is a preferable choice for
     local connections on such systems.

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 3e21a11c8fbc03f32a94e8e242f8982e9188a2bc..5c3b39e937fa26550f20f093164a133e7e73c3b4 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -21,6 +21,9 @@
 #include <sys/uio.h>
 #include <sys/ucred.h>
 #endif
+#ifdef HAVE_UCRED_H
+# include <ucred.h>
+#endif
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <unistd.h>
@@ -1611,6 +1614,43 @@ ident_unix(int sock, char *ident_user)
 
        strlcpy(ident_user, pass->pw_name, IDENT_USERNAME_MAX + 1);
 
+       return true;
+#elif defined(HAVE_GETPEERUCRED)
+       /* Solaris > 10 */
+       uid_t           uid;
+       struct passwd *pass;
+       ucred_t    *ucred;
+
+       ucred = NULL; /* must be initialized to NULL */
+       if (getpeerucred(sock, &ucred) == -1)
+       {
+               ereport(LOG,
+                               (errcode_for_socket_access(),
+                                errmsg("could not get peer credentials: %m")));
+               return false;
+       }
+
+       if ((uid = ucred_geteuid(ucred)) == -1)
+       {
+               ereport(LOG,
+                               (errcode_for_socket_access(),
+                                errmsg("could not get effective UID from peer credentials: %m")));
+               return false;
+       }
+
+       ucred_free(ucred);
+
+       pass = getpwuid(uid);
+       if (pass == NULL)
+       {
+               ereport(LOG,
+                       (errmsg("local user with ID %d does not exist",
+                                       (int) uid)));
+               return false;
+       }
+
+       strlcpy(ident_user, pass->pw_name, IDENT_USERNAME_MAX + 1);
+
        return true;
 #elif defined(HAVE_STRUCT_CMSGCRED) || defined(HAVE_STRUCT_FCRED) || (defined(HAVE_STRUCT_SOCKCRED) && defined(LOCAL_CREDS))
        struct msghdr msg;

diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in
index 2314d81965985e4c838b5643fbf31aaadc5393d9..9f6f21bf817efedfcc7dec0db3c6437600ecf311 100644 (file)
--- a/src/include/pg_config.h.in
+++ b/src/include/pg_config.h.in
@@ -182,6 +182,9 @@
 /* Define to 1 if you have the `getpeereid' function. */
 #undef HAVE_GETPEEREID
 
+/* Define to 1 if you have the `getpeerucred' function. */
+#undef HAVE_GETPEERUCRED
+
 /* Define to 1 if you have the `getpwuid_r' function. */
 #undef HAVE_GETPWUID_R
 
@@ -557,6 +560,9 @@
 /* Define to 1 if you have the external array `tzname'. */
 #undef HAVE_TZNAME
 
+/* Define to 1 if you have the <ucred.h> header file. */
+#undef HAVE_UCRED_H
+
 /* Define to 1 if the system has the type `uint64'. */
 #undef HAVE_UINT64