RBAC policy for unix socket peer uid/gid
Open
area/rbac
design proposal
help wanted
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 430
Description
It would be nice to be able to specify a RBAC policy based on the UID or GID of the downstream connection when it's coming through a unix socket.
This would involve exposing the UID/GID on the Connection if applicable. This would be done by using `SO_PEERCRED` to get the peer credentials from the socket.
A RBAC policy would then be added to read this data.
The use case we have in mind here is restricting certain routes to be available only to users that can assume a specific unix group.
Contributor guide
Assessment
This issue has not been assessed yet.