Skip to content

GH-135357: Add SO_PASSRIGHTS constant #135355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Conversation

ltworf
Copy link

@ltworf ltworf commented Jun 10, 2025

This adds the newly introduced SO_PASSRIGHT constant to the socket module.


📚 Documentation preview 📚: https://cpython-previews--135355.org.readthedocs.build/

@python-cla-bot
Copy link

python-cla-bot bot commented Jun 10, 2025

All commit authors signed the Contributor License Agreement.

CLA signed

@bedevere-app
Copy link

bedevere-app bot commented Jun 10, 2025

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

Copy link
Contributor

@StanFromIreland StanFromIreland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For reference.

This will need a blurb (which requires an issue) and you need to sign the CLA.

@ltworf ltworf changed the title Add SO_PASSRIGHTS constant GH-135357: Add SO_PASSRIGHTS constant Jun 10, 2025
@ltworf ltworf requested a review from StanFromIreland June 10, 2025 17:57
@ltworf
Copy link
Author

ltworf commented Jun 10, 2025

And now CLA is failing?

Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Copy link
Contributor

@efimov-mikhail efimov-mikhail left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Member

@ZeroIntensity ZeroIntensity left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm generally not a fan of just copying random flags that were recently added in Linux over to the standard library. This flag was added a mere 3 weeks ago, and seems to be incredibly low-level.

Does anyone know what it actually does, or what use case it has in Python?

@vstinner
Copy link
Member

Does anyone know what it actually does, or what use case it has in Python?

https://lwn.net/Articles/1023085/ describes SO_PASSRIGHTS:

One of the more obscure features provided by Unix-domain sockets is the ability to pass a file descriptor from one process to another. This feature is often used to provide access to a specific file or network connection to a process running in a relatively unprivileged context. But what if the recipient doesn't want a new file descriptor? A feature added for the 6.16 release makes it possible to refuse that offer.

@ZeroIntensity
Copy link
Member

Oh, Linux 6.16 hasn't even released yet. We've rejected adding recent Linux flags in the past, and I think that should apply here too; let's wait until there's an actual desire for it before adding it to the standard library.

@ltworf
Copy link
Author

ltworf commented Jun 11, 2025

Yes I know what the flag does and I was planning on using it. Also linux kernels and python release schedules do not match, and linux is faster.

Anyway do as you please.

@ltworf
Copy link
Author

ltworf commented Jun 11, 2025

It's a security flag for unix sockets. https://lwn.net/Articles/1023085/

@ZeroIntensity
Copy link
Member

I'm not opposed to adding it in general, I just don't want to right now, because it won't actually be on any Linux systems for a couple more months. We have until May of next year to get this in, and even longer before 3.15.0 gets released, so there's no rush here.

It would also help if you could provide a concrete example of how this would be used in Python code. That's not too clear to me at the moment.

@ltworf
Copy link
Author

ltworf commented Jun 11, 2025

It would be used by a normal sock.setoskcopt to disallow file descriptors. Which would be a sane thing to do by default but can't be done because of backwards compatibility.

Copy link
Member

@ZeroIntensity ZeroIntensity left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm marking this as DO-NOT-MERGE for now. The actual changes look good, but my concern is that basically nobody supports or uses this flag (yet), because it's only in an unreleased Linux version. Let's come back to this in a few months. Thanks!

@@ -0,0 +1 @@
Add support for :data:`!socket.SO_PASSRIGHTS` on linux.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Add support for :data:`!socket.SO_PASSRIGHTS` on linux.
Add support for :data:`!socket.SO_PASSRIGHTS` on Linux.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants