IP_PASSSEC(2const)

💖 IP_PASSSEC 💖

okay so bestie, quick vibe check: this is a manual page from the 2const girlies, meaning it's one of those constant-flavored pages. The star of the show? IP_PASSSEC — receive the security context of the peer socket. Yes queen, we're getting labeled. 🎀

---

✨ NAME ✨

IP_PASSSEC — receive the security context of the peer socket

📚 LIBRARY 📚

Standard C library (libc, -lc). The classics, fr fr. 🫶

🌸 SYNOPSIS 🌸

#include <netinet/in.h>  /* Definition of IP* constants */
#include <sys/socket.h>

int setsockopt(int sockfd, IPPROTO_IP, IP_PASSSEC,
               const int *enable, sizeof(int));
int getsockopt(int sockfd, IPPROTO_IP, IP_PASSSEC,
               int *enabled, sizeof(int));

👑 DESCRIPTION 👑

So here's the tea. If labeled IPSEC or NetLabel is configured on the sending and receiving hosts, this option enables receiving of the security context of the peer socket in an ancillary message of type SCM_SECURITY, and you get that little treat out via recvmsg(2). Obsessed with her honestly. 💅

This option is supported only for UDP sockets — like, that's her lane, she's not crossing it. For TCP or SCTP sockets, go see SO_PEERSEC(2const) instead, bestie. 🌈

The security context returned in the SCM_SECURITY ancillary message is of the same format as the one described in SO_PEERSEC(2const). Same flavor, different girl. ✨

😭 ERRORS 😭

Not reinventing the wheel here:

• See IPPROTO_IP(2const).
• See setsockopt(2).
• See ip(7).

🦋 STANDARDS 🦋

Linux. That's it, that's the whole standard. 🐧

⭐ HISTORY ⭐

Linux 2.6.17. A little retro, a little iconic. 👑

💀 CAVEATS 💀

okay this part is lowkey juicy. The reuse of the SCM_SECURITY message type for the IP_PASSSEC socket option was likely a mistake — bestie, they fumbled it a bit. 😭 Because other IP control messages use their own numbering scheme in the IP namespace, and they often just use the socket option value as the message type.

Good news though: there is no conflict currently, since the IP option with the same value as SCM_SECURITY is IP_HDRINCL(2const) — and that one is never used for a control message type. So like… crisis averted, but keep that in your notes. 🍓

fr fr, remember this is a historical design choice, not a behavior you should count on being pretty. Nobody's fixing it, but nobody's fighting it either.

👀 SEE ALSO 👀

• IPPROTO_IP(2const)
• setsockopt(2)
• ip(7)

---

and that's the whole page bestie, no notes. this was brought to you by Linux man-pages 6.20, dated 2025-11-25 — go off, IP_PASSSEC(2const), you ate 🎀✨💜