Re: [PATCH 3/7] man/man7/unix.7: Autobind: Clarify when it happens, and mention SO_PASSPIDFD

[Kuniyuki Iwashima <kuniyu@google.com>]

On Mon, 26 Oct 2026 22:55:49 +0100, Günther Noack wrote:
> On Sat, Oct 24, 2026 at 04:57:58AM +0000, Kuniyuki Iwashima wrote:
> > On Wed, 21 Oct 2026 23:22:52 +0200, Günther Noack wrote:
> > > Autobind happens if either one of SO_PASSCRED/SO_PASSPIDFD is set and
> > > either connect() or sendmsg() happens.  Mention SO_PASSPIDFD and
> > > clarify that autobind does not happen immediately when setting these
> > > socket options.
> > > 
> > > In linux.git net/unix/af_unix.c, unix_autobind() is called by
> > > unix_dgram_connect(), unix_stream_connect() and unix_dgram_sendmsg(),
> > > if the socket has no address and unix_may_passcred() is true.
> > > 
> > > unix_may_passcred() is also true when SO_PASSPIDFD is set, which was
> > > added in linux.git 5e2ff6704a27 (2023-06-12; "scm: add SO_PASSPIDFD and
> > > SCM_PIDFD"), Linux 6.5.
> > > 
> > > Also, the old text said "not yet connected", but the condition is
> > > about the socket not being bound.
> > > 
> > > Fixes: 9d1fd1157306 (1999-06-15, 2022-12-19; "man-pages 1.24")
> > > Fixes: 0cf2caa41ea6 (2010-10-10; "unix.7: Document the autobind feature")
> > > Cc: Michael Kerrisk <mtk.manpages@gmail.com>
> > > Cc: Alexander Mikhalitsyn <alexander@mihalicyn.com>
> > > Cc: Kuniyuki Iwashima <kuniyu@google.com>
> > > Assisted-by: LLM
> > > Signed-off-by: Günther Noack <gnoack3000@gmail.com>
> > > ---
> > > 
> > > Notes:
> > >     Rephrased the LLM-generated text so that the canonical description is
> > >     in the "Autobind feature" section and the other place just refers to
> > >     it.
> > >     
> > >     SO_PASSPIDFD is unfortunately not documented yet at this point in
> > >     time, but it's still correct to mention it here.
> > > 
> > >  man/man7/unix.7 | 25 ++++++++++++++++++++-----
> > >  1 file changed, 20 insertions(+), 5 deletions(-)
> > > 
> > > diff --git a/man/man7/unix.7 b/man/man7/unix.7
> > > index a1dce8c47246..ded82768322b 100644
> > > --- a/man/man7/unix.7
> > > +++ b/man/man7/unix.7
> > > @@ -301,8 +301,14 @@ if the sender did not specify
> > >  .B SCM_CREDENTIALS
> > >  ancillary data.
> > >  .IP
> > > -When this option is set and the socket is not yet connected,
> > > -a unique name in the abstract namespace will be generated automatically.
> > > +When this option is set on a socket that is not bound to an address,
> > > +the socket is autobound to a unique name in the abstract namespace
> > > +when
> > > +.BR connect (2)
> > > +or
> > > +.BR sendmsg (2)
> > > +is called on it;
> > > +see "Autobind feature", below.
> > >  .IP
> > >  The value given as an argument to
> > >  .BR setsockopt (2)
> > > @@ -370,10 +376,19 @@ call specifies
> > >  as
> > >  .IR sizeof(sa_family_t) ,
> > >  .\" i.e., sizeof(short)
> > > -or the
> > > +or if
> > > +.BR connect (2)
> > > +or
> > > +.BR sendmsg (2)
> > > +is called on a socket that was
> > > +not explicitly bound to an address
> > > +and that has the
> > >  .B SO_PASSCRED
> > > -socket option was specified for a socket that was
> > > -not explicitly bound to an address,
> > > +or
> > > +.\" commit 5e2ff6704a275be009be8979af17c52361b79b89
> > 
> > Do we really need this SHA1 here ?
> 
> I'll drop it, since it's already pointed out in the commit message.
> It seemed like the convention in these man pages, but apparently it's
> not needed any more, as Alejandro also remarked in [1].
> 
> [1] https://lore.kernel.org/all/atulJkR7fAgyKhPP@debian/
> 
> 
> > > +.B SO_PASSPIDFD
> > > +(since Linux 6.5)
> > > +socket option enabled,
> > 
> > You will need to update here with SO_PASSPIDFD_THREAD,
> > https://lore.kernel.org/netdev/20261005-work-unix-passpidfd-v4-3-350183b6e02a@amutable.com/
> 
> SO_PASSPIDFD_THREAD did not make it into Linux 7.3, and man pages
> document stable features only, so it will have to go separately at a
> later point in time.
> 
> 
> > but I'm not sure to what extent you want to clarify things.
> > 
> > For example, is "the socket is autobound when it passes
> > credentials or pidfd but is not yet bound." too vague ?
> 
> In my ears, "passing credentials" might as well mean that the current
> credentials are being *sent* over the socket, rather than received.
> We could maybe say "when it is configured to receive credentials or
> pidfd"?  (But at that point, it's similarly long and less precise than
> just listing the socket options.)  I'd keep it as is for now, if
> that's OK.

Fair enough :)