GH-135357: Add SO_PASSRIGHTS constant

[ltworf]

This adds the newly introduced SO_PASSRIGHT constant to the socket module.

---

📚 Documentation preview 📚: https://cpython-previews--135355.org.readthedocs.build/

• Issue: Add SO_PASSRIGHTS constant to socket module #135357

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[bedevere-app]

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

[StanFromIreland]

For reference.

This will need a blurb (which requires an issue) and you need to sign the CLA.

[ltworf]

And now CLA is failing?

[efimov-mikhail]

LGTM

[ZeroIntensity]

I'm generally not a fan of just copying random flags that were recently added in Linux over to the standard library. This flag was added a mere 3 weeks ago, and seems to be incredibly low-level.

Does anyone know what it actually does, or what use case it has in Python?

[vstinner]

Does anyone know what it actually does, or what use case it has in Python?

https://lwn.net/Articles/1023085/ describes SO_PASSRIGHTS:

One of the more obscure features provided by Unix-domain sockets is the ability to pass a file descriptor from one process to another. This feature is often used to provide access to a specific file or network connection to a process running in a relatively unprivileged context. But what if the recipient doesn't want a new file descriptor? A feature added for the 6.16 release makes it possible to refuse that offer.

[ZeroIntensity]

Oh, Linux 6.16 hasn't even released yet. We've rejected adding recent Linux flags in the past, and I think that should apply here too; let's wait until there's an actual desire for it before adding it to the standard library.

[ltworf]

Yes I know what the flag does and I was planning on using it. Also linux kernels and python release schedules do not match, and linux is faster.

Anyway do as you please.

[ltworf]

It's a security flag for unix sockets. https://lwn.net/Articles/1023085/

[ZeroIntensity]

I'm not opposed to adding it in general, I just don't want to right now, because it won't actually be on any Linux systems for a couple more months. We have until May of next year to get this in, and even longer before 3.15.0 gets released, so there's no rush here.

It would also help if you could provide a concrete example of how this would be used in Python code. That's not too clear to me at the moment.

[ltworf]

It would be used by a normal sock.setoskcopt to disallow file descriptors. Which would be a sane thing to do by default but can't be done because of backwards compatibility.

[ZeroIntensity]

I'm marking this as DO-NOT-MERGE for now. The actual changes look good, but my concern is that basically nobody supports or uses this flag (yet), because it's only in an unreleased Linux version. Let's come back to this in a few months. Thanks!

[github-actions]

This PR is stale because it has been open for 30 days with no activity.

[vstinner]

Linux 6.16 was released on 27 July 2025. I remove the DO-NOT-MERGE label.

[vstinner]

LGTM.

I tested manually the PR on Fedora 43 (Linux kernel 6.19.11): I get the constant as expected.

>>> socket.SO_PASSRIGHTS
83

[vstinner]

Full example:

$ ./python
Python 3.15.0a8+ (heads/pr/135355:4dc5f8c39e5, Apr 27 2026, 14:45:48) [GCC 15.2.1 20260123 (Red Hat 15.2.1-7)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import socket
>>> sock=socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
>>> sock.getsockopt(socket.SOL_SOCKET, socket.SO_PASSRIGHTS)
1
>>> sock.setsockopt(socket.SOL_SOCKET, socket.SO_PASSRIGHTS, 0)
>>> sock.getsockopt(socket.SOL_SOCKET, socket.SO_PASSRIGHTS)
0