mesh-tools
bff1ac14a1
mesh/merge-gate head bff1ac14a198 merged into trunk 49c9002c04d3 beside mesh-controller#355@8c381172 — pass: builds mesh-host → ace, g14, novox, shanks; no…
mesh/repo-check head bff1ac14a198 merged into trunk 49c9002c04d3 beside mesh-controller#355@8c381172 — pass: its merge-check.sh passed
mesh/delivery delivered
mesh/delivery-group group release/57-config-and-provisioning delivered: every member is delivered
20 lines
1016 B
Go
20 lines
1016 B
Go
package meshcli
|
|
|
|
import "net"
|
|
|
|
// The kernel's word on who is at the other end of a socket, shared with the node-engine's other local socket, the
|
|
// write of a filled file (internal/filling, novox/hq ADR 0349 §4): one reading of it, so the two never judge a peer
|
|
// differently.
|
|
|
|
// PeerCredentials is the user id and process id of the process at the other end, as the kernel recorded them when
|
|
// it connected (SO_PEERCRED). Nothing the process says is read.
|
|
func PeerCredentials(conn *net.UnixConn) (uint32, int32, error) { return peerCredentials(conn) }
|
|
|
|
// SameNamespaces refuses a process whose mount or user namespace is not the engine's: a user id is this machine's
|
|
// account only in this machine's namespaces.
|
|
func SameNamespaces(pid int32) error { return namespacesOf(pid) }
|
|
|
|
// NotOwnDirectory says what is wrong with a socket's directory, or nothing: it must be a directory, not a link,
|
|
// owned by the account the engine runs as.
|
|
func NotOwnDirectory(dir string) string { return notOwnDirectory(dir) }
|