This was a recent discovery for me -- you can verify not only the peer uid/gid but also the pid using getsockopt so_peercred. It's very neat indeed (and this is what postgres uses in the pg_ident.conf):

https://github.com/postgres/postgres/blob/master/src/port/ge...