mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-12-27 12:21:22 -05:00
a3df991d3d
Add a wrapper around `struct cred` called `Credential`, and provide functionality to get the `Credential` associated with a `File`. Rust Binder must check the credentials of processes when they attempt to perform various operations, and these checks usually take a `&Credential` as parameter. The security_binder_set_context_mgr function would be one example. This patch is necessary to access these security_* methods from Rust. This Rust abstraction makes the following assumptions about the C side: * `struct cred` is refcounted with `get_cred`/`put_cred`. * It's okay to transfer a `struct cred` across threads, that is, you do not need to call `put_cred` on the same thread as where you called `get_cred`. * The `euid` field of a `struct cred` never changes after initialization. * The `f_cred` field of a `struct file` never changes after initialization. Signed-off-by: Wedson Almeida Filho <wedsonaf@gmail.com> Co-developed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Trevor Gross <tmgross@umich.edu> Reviewed-by: Benno Lossin <benno.lossin@proton.me> Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@gmail.com> Reviewed-by: Gary Guo <gary@garyguo.net> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/r/20240915-alice-file-v10-4-88484f7a3dcf@google.com Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Christian Brauner <brauner@kernel.org>
77 lines
2.9 KiB
Rust
77 lines
2.9 KiB
Rust
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
// Copyright (C) 2024 Google LLC.
|
|
|
|
//! Credentials management.
|
|
//!
|
|
//! C header: [`include/linux/cred.h`](srctree/include/linux/cred.h).
|
|
//!
|
|
//! Reference: <https://www.kernel.org/doc/html/latest/security/credentials.html>
|
|
|
|
use crate::{
|
|
bindings,
|
|
types::{AlwaysRefCounted, Opaque},
|
|
};
|
|
|
|
/// Wraps the kernel's `struct cred`.
|
|
///
|
|
/// Credentials are used for various security checks in the kernel.
|
|
///
|
|
/// Most fields of credentials are immutable. When things have their credentials changed, that
|
|
/// happens by replacing the credential instead of changing an existing credential. See the [kernel
|
|
/// documentation][ref] for more info on this.
|
|
///
|
|
/// # Invariants
|
|
///
|
|
/// Instances of this type are always ref-counted, that is, a call to `get_cred` ensures that the
|
|
/// allocation remains valid at least until the matching call to `put_cred`.
|
|
///
|
|
/// [ref]: https://www.kernel.org/doc/html/latest/security/credentials.html
|
|
#[repr(transparent)]
|
|
pub struct Credential(Opaque<bindings::cred>);
|
|
|
|
// SAFETY:
|
|
// - `Credential::dec_ref` can be called from any thread.
|
|
// - It is okay to send ownership of `Credential` across thread boundaries.
|
|
unsafe impl Send for Credential {}
|
|
|
|
// SAFETY: It's OK to access `Credential` through shared references from other threads because
|
|
// we're either accessing properties that don't change or that are properly synchronised by C code.
|
|
unsafe impl Sync for Credential {}
|
|
|
|
impl Credential {
|
|
/// Creates a reference to a [`Credential`] from a valid pointer.
|
|
///
|
|
/// # Safety
|
|
///
|
|
/// The caller must ensure that `ptr` is valid and remains valid for the lifetime of the
|
|
/// returned [`Credential`] reference.
|
|
pub unsafe fn from_ptr<'a>(ptr: *const bindings::cred) -> &'a Credential {
|
|
// SAFETY: The safety requirements guarantee the validity of the dereference, while the
|
|
// `Credential` type being transparent makes the cast ok.
|
|
unsafe { &*ptr.cast() }
|
|
}
|
|
|
|
/// Returns the effective UID of the given credential.
|
|
pub fn euid(&self) -> bindings::kuid_t {
|
|
// SAFETY: By the type invariant, we know that `self.0` is valid. Furthermore, the `euid`
|
|
// field of a credential is never changed after initialization, so there is no potential
|
|
// for data races.
|
|
unsafe { (*self.0.get()).euid }
|
|
}
|
|
}
|
|
|
|
// SAFETY: The type invariants guarantee that `Credential` is always ref-counted.
|
|
unsafe impl AlwaysRefCounted for Credential {
|
|
fn inc_ref(&self) {
|
|
// SAFETY: The existence of a shared reference means that the refcount is nonzero.
|
|
unsafe { bindings::get_cred(self.0.get()) };
|
|
}
|
|
|
|
unsafe fn dec_ref(obj: core::ptr::NonNull<Credential>) {
|
|
// SAFETY: The safety requirements guarantee that the refcount is nonzero. The cast is okay
|
|
// because `Credential` has the same representation as `struct cred`.
|
|
unsafe { bindings::put_cred(obj.cast().as_ptr()) };
|
|
}
|
|
}
|