SO_PEERSEC(2const)

💖 SO_PEERSEC 💖

okay bestie, listen — this is the manual page for SO_PEERSEC, a socket option from section 2const, and I promise it's not as scary as it sounds. it's literally just "hey, who am I talking to on the other end, security-wise?" and honestly? that's main character energy. 🦋

---

✨ NAME ✨

SO_PEERSEC — get the security context of a peer socket 👀

---

📚 LIBRARY 📚

Standard C library (libc, -lc)

---

🌸 SYNOPSIS 🌸

#include <sys/socket.h>

int getsockopt(int sockfd, SOL_SOCKET, SO_PEERSEC,
               void buf[size], size_t size);

---

💅 DESCRIPTION 💅

so here's the tea. if labeled IPSEC or NetLabel is configured on both the sending and the receiving hosts, this read-only socket option returns the security context of the peer socket connected to this socket. 🫶

by default, that's gonna be the same as the security context of the process that created the peer socket — unless it got overridden by the policy, or by some process that actually has the required permissions. (yes, permissions gatekeep. iconic of them.)

the argument you pass to getsockopt(2) is a pointer to a buffer of the specified length in bytes, and the security context string gets copied in there. okay but what if your buffer is too small? slay, don't panic:

• if the buffer length is less than the length of the security context string, then getsockopt(2) returns -1, sets errno to ERANGE, and hands you back the required length via size. 💀

so the caller should allocate at least NAME_MAX bytes for the buffer initially — although this is not guaranteed to be sufficient, bestie, so don't come for me. resizing the buffer to the returned length and retrying may be necessary. grow as a person. 🌱

also, the security context string may include a terminating null character in the returned length, but it is not guaranteed to do so: a security context "foo" might be represented as either {'f','o','o'} of length 3 or {'f','o','o','\0'} of length 4, which are considered to be interchangeable. 🙈 the string is printable, does not contain non-terminating null characters, and is in an unspecified encoding (in particular, it is not guaranteed to be ASCII or UTF-8 — so no, don't assume the vibes are UTF-8).

---

🔌 AF_UNIX 🔌

the use of this option for sockets in the AF_UNIX address family is supported since Linux 2.6.2 for connected stream sockets, and since Linux 4.18 also for stream and datagram socket pairs created using socketpair(2). no cap. ✨

---

🌐 AF_INET 🌐

for AF_INET sockets, labeled IPSEC or NetLabel needs to be configured on both the sending and receiving hosts. (both. both is good. 🫶)

the use of this option for sockets in the AF_INET address family is supported since Linux 2.6.17 for TCP sockets, and since Linux 4.17 for SCTP sockets.

now for the SELinux girlies: for SELinux, NetLabel conveys only the MLS portion of the security context of the peer across the wire, defaulting the rest of the security context to the values defined in the policy for the netmsg initial security identifier (SID). ✨ however ✨ NetLabel can be configured to pass full security contexts over loopback. labeled IPSEC always passes full security contexts as part of establishing the security association (SA) and looks them up based on the association for each packet. that's the difference, periodt. 💅

---

😭 ERRORS 😭

see SOL_SOCKET(2const). see setsockopt(2). see socket(7).

• ERANGE — the buffer size is not enough. bestie the buffer is not buffering. 💀

---

🕰️ HISTORY 🕰️

Linux 2.6.2.

---

👑 SEE ALSO 👑

SOL_SOCKET(2const), setsockopt(2), socket(7)

---

and that's the whole page, babe 🎀 this one came straight out of Linux man-pages 6.20 and it was dated 2025-12-01 — so go forth, call getsockopt(2), pass SO_PEERSEC, and size your buffers correctly or the ERANGE will find you. mwah. 💜🌟