From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f74.google.com (mail-wr1-f74.google.com [209.85.221.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E3733C1F46 for ; Fri, 29 May 2026 09:33:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.74 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780047196; cv=none; b=BkRMbjbjaT1S5D9+PVxPQ6zg/O4D8DmsEotUnNMDNEMY6i6dJ4LnSHHSg+nPj3NjjAE5vXWEXJhcsg2pWKctriqJwsiouaM8ebtfL3pz0fmNmYmI9kqM1aYpW2PyskTcsGdclCSWpW0I+IcTzDPsp8w5Ucl32zeu6lx4eJGDwGM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780047196; c=relaxed/simple; bh=m2M1hqLeBWvqPQs5ztdeH6LdezGSXUVSFlb8F3nedpI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=bPV8C//2ipajNdYHoYEejZI/PhLWnM232BY+Xvy++quUOkfaQM/tg+PqWLXK2RzbqLeki0NoFHlWxPfSoFNGhgHs3fFK3oy4s60M2074HkcEoNxi+/XTFD1quOYekOBgR+rd9oQQ8Hk+ap64ZY9qJpOHAdzW/uQHcKoyrHba38Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=olRzD6fO; arc=none smtp.client-ip=209.85.221.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="olRzD6fO" Received: by mail-wr1-f74.google.com with SMTP id ffacd0b85a97d-45e80183514so9626539f8f.3 for ; Fri, 29 May 2026 02:33:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780047194; x=1780651994; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=pgBUNf+zONY3y3bIHQzKq/7IR7Q4CQOsSs3bYWLSYZ8=; b=olRzD6fOMf+OEJeRU3XYfOkQy3JsNjFLpkd7vuXx7TyszH2ddkCAd8xJZiPDfTbmkf CpSNNADCccBIRI6A1IFSFNIj/w9p7t3L7+M5Aun3BbruK8uUweFdu9Lfz+f0zVKF72b/ ZQnzBAJd7GU50KRLwO1E9QkW8UleKsMxhOcSZu2k8LXHdyodAXZ1mxwFFnehZpKPjp37 ly5aZ5Cb56VEy+Mb6az1n0Ls2BIPdcgmDQsZgYU1zHTOJMvCkEe3N2FxAMd4orEnIyzI 801jn/cvhwAJTlwJUqFI781PETlX1Hr2F08qhA88lEg8TBpBPgYIxi9baW+nRcprBYIW +ojg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780047194; x=1780651994; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=pgBUNf+zONY3y3bIHQzKq/7IR7Q4CQOsSs3bYWLSYZ8=; b=AWF3catCMBd0oml0QWLZ43EVPI9ykGdNfMiJde/0mUykA0TyrnMNL6z/Gj2RTJN/kG ud2P91ngqqyPoo8ArGnQ7VtHxzRxG20lY4bKxoCZRFZ8luePy97vJ4g4c2AimmftxUm0 +LYKGAojRBYUsZwU8fSXSTUUuNYb0Yz98sTA7faalX+o9M+NiHFe4bbvz1p2YBAaPv3w gvpascsLxkzQZv3LbONNz8a/TR9PJB3mGL9dBV29+X4l7GIe9wvgwVqKiYvwJCIu30/m Uf6Axmpic/yIk535d3wqcYj6Hi4Anh9xGUjN2GThze5fpVvM6S4AWcBxT5h0qgr1lHUJ I0ng== X-Forwarded-Encrypted: i=1; AFNElJ8r/ovYoXDECJ/I3thc/OmxLgefkaMNkp8qUvxUACiMNUJM2hGmjuHAGN38rHxVm2efurfp7fo/vnK3Jnk=@vger.kernel.org X-Gm-Message-State: AOJu0YxoiGa3+TC4B9JbSTOIalTBKtmJxwuhnVkTm49gYTmGMIoyp/PZ /3jD63tcB65USaZZAp8r9mhvLh9hUC86EnG0pYVURdE9JF6TJeX1GhJbzRT+CDhnGF0An3d13rI TL1dmOqsKsnZsBg3OdQ== X-Received: from wrux14.prod.google.com ([2002:a5d:650e:0:b0:45e:e154:705f]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:adf:e405:0:b0:451:3b12:9bca with SMTP id ffacd0b85a97d-45ef14659f6mr2944656f8f.25.1780047193368; Fri, 29 May 2026 02:33:13 -0700 (PDT) Date: Fri, 29 May 2026 09:33:01 +0000 In-Reply-To: <20260529-remove-task-euid-v4-0-07cbdf3af980@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260529-remove-task-euid-v4-0-07cbdf3af980@google.com> X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=2697; i=aliceryhl@google.com; h=from:subject:message-id; bh=y1KXlGVYnm1pX/oKAuz20EvxJFYU3EACcVg7zUuAQwU=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqGV1WXEt0VAFuXMCffSAPXG9HpCtsPqdouwXhX XnBDBRN3c+JAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCahldVgAKCRAEWL7uWMY5 RrYkEACDEvg+5bfmrGM9ko1sQki3qLPW2T4znB2zmDUHgZNcCoAeUS+1E/N3khEN53mzLCRkyru uVflfG8A/cGB264unm9GM8Xnlr8dQX0Hy9feDf39WXQNJhj+tybCqP7/7GTETTVqkoiFBhbNH9j /iD9+ynhtE410KedhBGDSUMzBQgMTnX0qqPmNe1uLGMBObaC/xWHTCbZGBZGCaQg+nWs2xlQp1S VJt26fhOLhYNsuV9kqfKCRFVmL1butWHBLpALID8TbfPMvkhkXVx10T9B3r3B8oYx1XddfTqZUw Fl8fdSFF5LcAIt/dxXFmROZ3r1BGo8gFn8SWbmlhpvGJBBX79vjXVXWVmCVHcRUKtsRoAaa2xRE xYoZ8p3ioNz+Rr8OFPHym/qcLkUpLiHhOC2e/BVgDvDWa3WO2at56aUVQypcn4q9mLNoP7Gj/eK LjE1tEBlHBOV/EaVRtE8K85jLHiM9mCuFRIihTcQIBbQjHIjAnXlBJ1wxomAqjaYYGyRxsbAEX1 Y1s8rHibSIqjdtF7G6/QaXLxPyLDzba8+Ylxct00FVQReZm2kkv+DXCzQe7VSP9G2yMLIDpJqpy DDGoAyiesecIpl35K3nUUA/qHnX7eL//wAJANF3k/ycHy6y4PMcOwOT/e96E9cc3OsQSt8aiEMN gTR8pOiW3e11plw== X-Mailer: b4 0.14.3 Message-ID: <20260529-remove-task-euid-v4-1-07cbdf3af980@google.com> Subject: [PATCH v4 1/2] rust: task: clarify comments on task UID accessors From: Alice Ryhl To: Paul Moore , Serge Hallyn , Jonathan Corbet , Greg Kroah-Hartman , Shuah Khan , Alex Shi , Yanteng Si , Dongliang Mu Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , Jann Horn , linux-security-module@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org, Alice Ryhl Content-Type: text/plain; charset="utf-8" From: Jann Horn Linux has separate subjective and objective task credentials, see the comment above `struct cred`. Clarify which accessor functions operate on which set of credentials. Also document that Task::euid() is a very weird operation. You can see how weird it is by grepping for task_euid() - binder is its only user. Task::euid() obtains the objective effective UID - it looks at the credentials of the task for purposes of acting on it as an object, but then accesses the effective UID (which the credentials.7 man page describes as "[...] used by the kernel to determine the permissions that the process will have when accessing shared resources [...]"). For context: Arguably, binder's use of task_euid() is a theoretical security problem, which only has no impact on Android because Android has no setuid binaries executable by apps. commit 29bc22ac5e5b ("binder: use euid from cred instead of using task") fixed that by removing that only user of task_euid(), but the fix got reverted in commit c21a80ca0684 ("binder: fix test regression due to sender_euid change") because some Android test started failing. Signed-off-by: Jann Horn Signed-off-by: Alice Ryhl --- Originally sent as: https://lore.kernel.org/r/20260212-rust-uid-v1-1-deff4214c766@google.com --- rust/kernel/task.rs | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs index 38273f4eedb5..eabd65bfde12 100644 --- a/rust/kernel/task.rs +++ b/rust/kernel/task.rs @@ -210,14 +210,17 @@ pub fn pid(&self) -> Pid { unsafe { *ptr::addr_of!((*self.as_ptr()).pid) } } - /// Returns the UID of the given task. + /// Returns the objective real UID of the given task. #[inline] pub fn uid(&self) -> Kuid { // SAFETY: It's always safe to call `task_uid` on a valid task. Kuid::from_raw(unsafe { bindings::task_uid(self.as_ptr()) }) } - /// Returns the effective UID of the given task. + /// Returns the objective effective UID of the given task. + /// + /// You should probably not be using this; the effective UID is normally + /// only relevant in subjective credentials. #[inline] pub fn euid(&self) -> Kuid { // SAFETY: It's always safe to call `task_euid` on a valid task. @@ -371,7 +374,7 @@ fn eq(&self, other: &Self) -> bool { impl Eq for Task {} impl Kuid { - /// Get the current euid. + /// Get the current subjective effective UID. #[inline] pub fn current_euid() -> Kuid { // SAFETY: Just an FFI call. -- 2.54.0.823.g6e5bcc1fc9-goog