The accepted server-side socket is created with sock_clone(), which gives
it pflocal's own uid/gid (normally root), so fstat() on the accepted
AF_LOCAL socket reports root rather than the connecting user.  Copy the
connecting socket's uid/gid onto the clone, so the accepting side can
learn the peer's credentials with fstat().

* pflocal/socket.c (S_socket_connect): Copy sock->uid/gid to the server
clone.
---
 pflocal/socket.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pflocal/socket.c b/pflocal/socket.c
index d60bece..cad2a0c 100644
--- a/pflocal/socket.c
+++ b/pflocal/socket.c
@@ -136,6 +136,8 @@ S_socket_connect (struct sock_user *user, struct addr *addr)
                  err = sock_clone (peer, &server);
                  if (!err)
                    {
+                     server->uid = sock->uid;
+                     server->gid = sock->gid;
                      err = sock_connect (sock, server);
                      if (!err)
                        {
-- 
2.47.3


Reply via email to