diff --git a/AUTHORS b/AUTHORS
new file mode 100644
index 0000000..5498a87
--- /dev/null
+++ b/AUTHORS
@@ -0,0 +1 @@
+Tailscale Inc
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..2154c3f
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,5 @@
+module inet.af/peercred
+
+go 1.14
+
+require golang.org/x/sys v0.0.0-20210216163648-f7da38b97c65
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..5f07646
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,2 @@
+golang.org/x/sys v0.0.0-20210216163648-f7da38b97c65 h1:pTMjDVnP5eVRRlWO76rEWJ8JoC6Lf1CmyjPZXRiy2Sw=
+golang.org/x/sys v0.0.0-20210216163648-f7da38b97c65/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
diff --git a/peercred.go b/peercred.go
new file mode 100644
index 0000000..f84aa9a
--- /dev/null
+++ b/peercred.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2021 AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package peercred maps from a net.Conn to information about the
+// other side of the connection, using various OS-specific facilities.
+package peercred // import "inet.af/peercred"
+
+import (
+	"errors"
+	"net"
+	"runtime"
+)
+
+// Creds are the peer credentials.
+type Creds struct {
+	pid int
+	uid string
+}
+
+func (c *Creds) PID() (pid int, ok bool) {
+	return c.pid, c.pid != 0
+}
+
+// UserID returns the userid (or Windows SID) that owns the other side
+// of the connection, if known. (ok is false if not known)
+// The returned string is suitable to passing to os/user.LookupId.
+func (c *Creds) UserID() (uid string, ok bool) {
+	return c.uid, c.uid != ""
+}
+
+var osGet func(net.Conn) (*Creds, error)
+
+var (
+	ErrNotImplemented      = errors.New("not implemented on " + runtime.GOOS)
+	ErrUnsupportedConnType = errors.New("unsupported connection type")
+)
+
+// Get returns the peer credentials for c.
+//
+// For unsupported system, the error is ErrNotImplemented.
+func Get(c net.Conn) (*Creds, error) {
+	if osGet == nil {
+		return nil, ErrNotImplemented
+	}
+	return osGet(c)
+}
diff --git a/peercred_unix_test.go b/peercred_unix_test.go
new file mode 100644
index 0000000..cc5d894
--- /dev/null
+++ b/peercred_unix_test.go
@@ -0,0 +1,62 @@
+// Copyright (c) 2021 AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build go1.15
+// +build linux
+
+package peercred // import "inet.af/peercred"
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestUnix(t *testing.T) {
+	d := t.TempDir()
+	path := filepath.Join(d, "foo.sock")
+	sock, err := net.Listen("unix", path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer sock.Close()
+
+	go func() {
+		c, err := net.Dial("unix", path)
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		c.Close()
+	}()
+
+	c, err := sock.Accept()
+	if err != nil {
+		t.Fatalf("Accept: %v", err)
+	}
+	defer c.Close()
+
+	creds, err := Get(c)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+
+	uid, ok := creds.UserID()
+	if !ok {
+		t.Errorf("no UID")
+	}
+	if got, want := uid, fmt.Sprint(os.Getuid()); got != want {
+		t.Errorf("UID = %q; want %q", got, want)
+	}
+	pid, ok := creds.PID()
+	if !ok {
+		t.Errorf("no PID")
+	}
+	if got, want := pid, os.Getpid(); got != want {
+		t.Errorf("PID = %v; want %v", got, want)
+	}
+
+}
diff --git a/peercredit_linux.go b/peercredit_linux.go
new file mode 100644
index 0000000..5b073fc
--- /dev/null
+++ b/peercredit_linux.go
@@ -0,0 +1,51 @@
+// Copyright (c) 2021 AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package peercred
+
+import (
+	"fmt"
+	"net"
+	"strconv"
+
+	"golang.org/x/sys/unix"
+)
+
+func init() {
+	osGet = getLinux
+}
+
+func getLinux(c net.Conn) (*Creds, error) {
+	switch c := c.(type) {
+	case *net.UnixConn:
+		return getUnix(c)
+	case *net.TCPConn:
+		// TODO: use /proc tcp info for localhost connections like Windows?
+	}
+	return nil, ErrUnsupportedConnType
+}
+
+func getUnix(c *net.UnixConn) (*Creds, error) {
+	raw, err := c.SyscallConn()
+	if err != nil {
+		return nil, fmt.Errorf("SyscallConn: %w", err)
+	}
+
+	var cred *unix.Ucred
+	cerr := raw.Control(func(fd uintptr) {
+		cred, err = unix.GetsockoptUcred(int(fd),
+			unix.SOL_SOCKET,
+			unix.SO_PEERCRED)
+	})
+	if cerr != nil {
+		return nil, fmt.Errorf("raw.Control: %w", err)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("unix.GetsockoptUcred: %w", err)
+	}
+	return &Creds{
+		pid: int(cred.Pid),
+		uid: strconv.FormatUint(uint64(cred.Uid), 10),
+	}, nil
+}