Re: [RFC PATCH v2 00/41] UUID and GUID user and group ids (*_r system calls)

[jan Koester <jan.koester@tuxist.de>]

Hi,

i have already submitted but not all patches arrives now i use a other  mailbox sorry.

best regards

Jan Koester

Am 21.10.26 um 05:15 schrieb Jan Koester:
> Hi,
>
> this RFC series lets a user or group id be a UUID (RFC 9562, version 4)
> or a Microsoft GUID as well as a classic 32-bit number. Processes can run
> as such a user, files can be owned by one, and credentials, ACLs, keys,
> System V IPC, sockets, signals, audit and procfs carry the whole id.
>
> Why
> ---
> Directory services name users by 128-bit ids: Active Directory by
> objectGUID (and SIDs), LDAP directories often by entryUUID. Today every
> system that serves such users (winbind, sssd, nfsidmap, ksmbd user
> space) maps them to 32-bit numbers through ranges, hashes or a local
> database. The numbers differ between machines unless the mapping is
> configured the same everywhere, mappings can collide, and ownership
> written to shared storage or a backup depends on the machine that wrote
> it. With the 128-bit id in the kernel, the id the directory hands out is
> also the owner on disk and in every credential, and no mapping table is
> needed.
>
> Design
> ------
> - kuid_t and kgid_t become a tagged union (legacy number, UUID, GUID)
>   instead of a u32. There is no table that maps UUIDs to numbers: the
>   kernel compares, hashes and stores the whole id. uid_eq(), uid_lt()
>   and the other helpers keep their meaning. Patches 1-3 add the UAPI
>   type and helpers. Patches 4-8 fix places that relied on kuid_t being
>   a u32: sk_uid is now read through a seqcount, and af_unix, netlink and
>   Bluetooth keep only classic ids in skb->cb. Patch 9 changes the type.
>
> - UUIDs and GUIDs exist only in the initial user namespace. They are not
>   part of any uid_map or gid_map, show as the overflow id in other
>   namespaces, and no capability in a child namespace gives privilege
>   over them. Idmapped mounts pass them through unchanged.
>
> - The classic system calls keep their 32-bit ids and show a UUID or GUID
>   as the overflow id, as the 16-bit calls do for ids above 65535. A new
>   family, named after the old calls with an _r suffix (getuid_r,
>   setresuid_r, setgroups_r, fchownat_r, ...), takes a 20-byte
>   __kernel_uid_r_t:
>
> 	typedef struct __kernel_uid_r {
> 		__u32 type;	/* UID_R_NONE, _LEGACY, _UUID, _GUID */
> 		union {
> 			__u32 legacy;
> 			__u8 uuid[16];
> 			__u8 guid[16];
> 		};
> 	} __kernel_uid_r_t;
>
>   It has the same layout on every ABI, so none of the calls needs a
>   compat entry.
>
> - Existing interfaces get _R variants where an id is in the ABI:
>   STATX_UID_R/STATX_GID_R, SO_PEERCRED_R, SO_PEERGROUPS_R,
>   SCM_CREDENTIALS_R, si_uid_r in siginfo (offset 96 in every layout),
>   IPC_STAT_R/IPC_SET_R, KEYCTL_CHOWN_R, and version 3 of the POSIX ACL
>   xattr. procfs, audit records, key descriptions and the RPCSEC_GSS
>   upcall use a text form (decimal, UUID, or GUID in braces).
>
> - A filesystem has to declare that it can store such owners
>   (SB_I_UID_R). Everywhere else, chown and creating a file as such a
>   user fail with EOVERFLOW, so a UUID never turns into a wrong number
>   on disk. tmpfs, ramfs and devpts declare it, overlayfs does when its
>   upper layer does, and ext4 does with a new read-only compatible
>   feature, uid_r (patches 31, 32 and 34; 256-byte inodes). NFSv4 and
>   ksmbd carry the ids as text or as SIDs (S-1-22-3/4/5/6-...).
>
> - Things that can't carry a 128-bit id fail closed instead of mapping:
>   quotas don't account such owners, AUTH_SYS sends the overflow id,
>   unprivileged ublk devices are refused, and gssd versions that don't
>   know uid_r= refuse the upcall.
>
> Documentation/userspace-api/uid_r.rst (patches 35 and 41) describes the
> whole ABI and its limitations.
>
> Testing
> -------
> - tools/testing/selftests/uid_r (patch 36): 14/14 pass.
> - A boot test suite (nolibc init on QEMU, ext4 images with and without
>   uid_r): 88/88 pass, on a kernel with USER_NS, overlayfs, tmpfs, POSIX
>   ACLs and audit enabled.
> - End to end on a full distribution (FenrirOS: patched libc, e2fsprogs,
>   OpenSSH, rsync, libarchive, a ksmbd and NFS server): UUID users log in
>   over ssh, own files on ext4, and reach ksmbd and NFSv4 shares.
> - The selftests and the boot test suite ran on the same series on top
>   of v7.2.9 and v7.2.11. On v7.3-rc7, the series is built for x86_64
>   (bzImage and modules, with USER_NS, audit, ecryptfs, fscrypt, quota,
>   ublk, NFS, Bluetooth and the LSMs enabled) and boots in QEMU, where an
>   integration test with a full user space passes 24/24: ssh sessions
>   with a pty as UUID users, UUID owners on tmpfs and overlayfs, SMB
>   logins of UUID users through ksmbd with S-1-22-3-... owner SIDs, and
>   NFSv4 showing and setting UUID owners. ext4 uid_r was not part of it.
> - The syscall tables of the other architectures are wired up (patch 22)
>   but haven't been built.
>
> The e2fsprogs changes (mke2fs/tune2fs -O uid_r, e2fsck, debugfs, ACL
> conversion in libext2fs) will be sent to linux-ext4 separately.
>
> Open questions
> --------------
> - Is a tagged union in kuid_t acceptable, or would you rather see the
>   128-bit id kept beside a u32 kuid_t?
> - The new calls copy the classic get/set*id() and chown() families
>   one by one (20 entries). A single setid_r(which, ...) call would need
>   fewer syscall numbers. Which do you prefer?
> - Should the series be split per subsystem (core/uidgid, fs and VFS,
>   net, ext4, nfsd/ksmbd) after this RFC?
>
> Changes in v2:
> - No code changes. v1 reached the lists only up to patch 11, the mail
>   provider throttled the rest; this is the complete series, now sent
>   from jan.koester@tuxist.de (author and Signed-off-by changed to it).
> - Hunk offsets refreshed against v7.3-rc7, testing section updated.
> - v1: https://lore.kernel.org/r/cover.1792346472.git.jan.koester@gmx.net
>
> The series is based on v7.3-rc7. The syscall numbers (473-492 on most
> architectures) are placeholders and will follow whatever is merged first.
>
> Jan Koester (41):
>   uuid: move uuid_t and guid_t into <linux/uuid_types.h>
>   uapi: add <linux/uidgid_r.h> for 128 bit capable user and group ids
>   uidgid: add uid_is_legacy() and gid_is_legacy()
>   net: sock: read sk_uid through a seqcount
>   af_unix: keep sender ids in skb->cb only when they are classic ids
>   netlink: keep classic sender ids in skb->cb
>   Bluetooth: keep classic sender ids in skb->cb
>   smb: client: use __kuid_val() for the unix SIDs of the caller
>   uidgid: let kuid_t and kgid_t hold a UUID or a GUID
>   uidgid: convert between kernel ids and the ids of the *_r system calls
>   fscrypt: show the whole uid in the description of user key claims
>   keys: name per-user keyrings of UUID and GUID users by the whole uid
>   ublk: refuse unprivileged devices to UUID and GUID users
>   nfsd: don't hand out uid 0 for read layouts of UUID-owned files
>   SUNRPC: name UUID and GUID users to gssd as uid_r=
>   ecryptfs: hash daemons by kuid_hash()
>   quota: don't account UUID and GUID owners
>   fs: keep UUID and GUID owners off filesystems that can't store them
>   cred: add the *_r variants of the get/set*id() system calls
>   groups: add getgroups_r() and setgroups_r()
>   fs: add chown_r(), lchown_r(), fchown_r() and fchownat_r()
>   arch: wire up the *_r uid and gid system calls
>   statx: report UUID and GUID owners
>   shmem, ramfs: allow UUID and GUID owners
>   uidgid: parse and print ids in their text form
>   proc: show UUID and GUID ids in status, accept them for loginuid
>   audit: log UUID and GUID ids in full
>   net: add SO_PEERCRED_R, SO_PEERGROUPS_R and SCM_CREDENTIALS_R
>   signal: report the sender's UUID or GUID uid in si_uid_r
>   ipc: add IPC_STAT_R and IPC_SET_R
>   ext4: add the uid_r feature for UUID and GUID owners
>   ext4: let uid_r be turned on while the filesystem is mounted
>   posix_acl: support UUID and GUID entries
>   ext4: store ACLs with UUID and GUID entries on uid_r filesystems
>   Documentation: describe UUID and GUID user and group ids
>   selftests: add tests for UUID and GUID ids
>   ovl: allow UUID and GUID owners when the upper layer does
>   devpts: allow UUID and GUID owners
>   ksmbd: log in UUID and GUID users and map them to SIDs
>   nfsd, nfs: carry UUID and GUID owners as their text form
>   Documentation: uid_r: describe SMB and NFSv4
>
>  Documentation/userspace-api/index.rst       |   1 +
>  Documentation/userspace-api/uid_r.rst       | 186 +++++++
>  arch/alpha/include/uapi/asm/socket.h        |   5 +
>  arch/alpha/kernel/syscalls/syscall.tbl      |  20 +
>  arch/arm/tools/syscall.tbl                  |  20 +
>  arch/arm64/tools/syscall_32.tbl             |  20 +
>  arch/m68k/kernel/syscalls/syscall.tbl       |  20 +
>  arch/microblaze/kernel/syscalls/syscall.tbl |  20 +
>  arch/mips/include/uapi/asm/socket.h         |   5 +
>  arch/mips/kernel/syscalls/syscall_n32.tbl   |  20 +
>  arch/mips/kernel/syscalls/syscall_n64.tbl   |  20 +
>  arch/mips/kernel/syscalls/syscall_o32.tbl   |  20 +
>  arch/parisc/include/uapi/asm/socket.h       |   5 +
>  arch/parisc/kernel/syscalls/syscall.tbl     |  20 +
>  arch/powerpc/kernel/syscalls/syscall.tbl    |  20 +
>  arch/s390/kernel/syscalls/syscall.tbl       |  20 +
>  arch/sh/kernel/syscalls/syscall.tbl         |  20 +
>  arch/sparc/include/uapi/asm/socket.h        |   5 +
>  arch/sparc/kernel/syscalls/syscall.tbl      |  20 +
>  arch/x86/entry/syscalls/syscall_32.tbl      |  20 +
>  arch/x86/entry/syscalls/syscall_64.tbl      |  20 +
>  arch/xtensa/kernel/syscalls/syscall.tbl     |  20 +
>  drivers/block/ublk_drv.c                    |  17 +-
>  drivers/tty/tty_audit.c                     |   7 +-
>  fs/attr.c                                   |   7 +
>  fs/crypto/keyring.c                         |   7 +-
>  fs/devpts/inode.c                           |   2 +
>  fs/ecryptfs/messaging.c                     |   2 +-
>  fs/ext4/acl.c                               | 109 +++-
>  fs/ext4/acl.h                               |  34 +-
>  fs/ext4/ext4.h                              |  27 +-
>  fs/ext4/inode.c                             | 115 ++++-
>  fs/ext4/ioctl.c                             |  30 +-
>  fs/ext4/super.c                             |  45 +-
>  fs/mnt_idmapping.c                          |  14 +
>  fs/nfs/nfs4idmap.c                          |  53 ++
>  fs/nfs/super.c                              |   2 +
>  fs/nfsd/flexfilelayout.c                    |   6 +-
>  fs/nfsd/nfs4idmap.c                         |  68 ++-
>  fs/open.c                                   | 144 +++++-
>  fs/overlayfs/super.c                        |   3 +
>  fs/posix_acl.c                              | 123 ++++-
>  fs/proc/array.c                             |  17 +-
>  fs/proc/base.c                              |  38 +-
>  fs/quota/dquot.c                            |   3 +
>  fs/ramfs/inode.c                            |   1 +
>  fs/signalfd.c                               |   3 +
>  fs/smb/client/cifsacl.c                     |   2 +-
>  fs/smb/client/smb2pdu.c                     |   7 +-
>  fs/smb/server/ksmbd_netlink.h               |  15 +-
>  fs/smb/server/mgmt/user_config.c            |  35 +-
>  fs/smb/server/mgmt/user_config.h            |   4 +-
>  fs/smb/server/smb2pdu.c                     |  10 +-
>  fs/smb/server/smb_common.c                  |  18 +-
>  fs/smb/server/smbacl.c                      | 178 +++++--
>  fs/smb/server/smbacl.h                      |  19 +-
>  fs/smb/server/transport_ipc.c               |   4 +-
>  fs/smb/server/vfs_cache.c                   |   9 +-
>  fs/smb/server/vfs_cache.h                   |   4 +-
>  fs/stat.c                                   |  24 +-
>  include/linux/audit.h                       |   8 +-
>  include/linux/compat.h                      |   6 +
>  include/linux/fs.h                          |  29 +-
>  include/linux/fs/super_types.h              |   1 +
>  include/linux/mnt_idmapping.h               |  74 ++-
>  include/linux/netlink.h                     |   2 +-
>  include/linux/posix_acl_xattr.h             |  31 ++
>  include/linux/ptrace.h                      |   2 +-
>  include/linux/quota.h                       |  18 +
>  include/linux/signal.h                      |  22 +
>  include/linux/signal_types.h                |   5 +-
>  include/linux/socket.h                      |   1 +
>  include/linux/syscalls.h                    |  44 ++
>  include/linux/uidgid.h                      | 165 +++++-
>  include/linux/uidgid_types.h                |  32 +-
>  include/linux/uuid.h                        |  11 +-
>  include/linux/uuid_types.h                  |  21 +
>  include/net/bluetooth/bluetooth.h           |   2 +-
>  include/net/scm.h                           |  28 +
>  include/net/sock.h                          |  32 +-
>  include/uapi/asm-generic/siginfo.h          |  17 +
>  include/uapi/asm-generic/socket.h           |   5 +
>  include/uapi/asm-generic/unistd.h           |  43 +-
>  include/uapi/linux/ipc.h                    |  17 +
>  include/uapi/linux/keyctl.h                 |   1 +
>  include/uapi/linux/posix_acl_xattr.h        |  19 +
>  include/uapi/linux/signalfd.h               |   4 +-
>  include/uapi/linux/socket.h                 |   9 +
>  include/uapi/linux/stat.h                   |  10 +-
>  include/uapi/linux/uidgid_r.h               |  45 ++
>  io_uring/waitid.c                           |  32 +-
>  io_uring/waitid.h                           |   1 +
>  ipc/mqueue.c                                |   4 +-
>  ipc/msg.c                                   |  40 +-
>  ipc/sem.c                                   |  31 +-
>  ipc/shm.c                                   |  32 +-
>  ipc/util.c                                  | 112 +++-
>  ipc/util.h                                  |  23 +-
>  kernel/Makefile                             |   1 +
>  kernel/audit.c                              |  50 +-
>  kernel/audit.h                              |   4 +-
>  kernel/auditsc.c                            |  63 ++-
>  kernel/exit.c                               |  18 +-
>  kernel/exit.h                               |   3 +
>  kernel/groups.c                             |  94 +++-
>  kernel/signal.c                             |  48 +-
>  kernel/sys.c                                | 472 ++++++++++++-----
>  kernel/sys_ni.c                             |  12 +
>  kernel/ucount.c                             |   2 +-
>  kernel/uidgid_r.c                           | 467 +++++++++++++++++
>  kernel/user.c                               |   2 +-
>  kernel/user_namespace.c                     |  10 +-
>  lib/kobject_uevent.c                        |   8 +-
>  mm/oom_kill.c                               |   2 +-
>  mm/shmem.c                                  |   2 +
>  net/bluetooth/hci_sock.c                    |   8 +-
>  net/core/dev.c                              |   8 +-
>  net/core/scm.c                              |  94 ++--
>  net/core/sock.c                             |  90 +++-
>  net/netlabel/netlabel_user.c                |   4 +-
>  net/netlink/af_netlink.c                    |   4 +-
>  net/socket.c                                |   5 +-
>  net/sunrpc/auth_gss/auth_gss.c              |  44 +-
>  net/unix/af_unix.c                          |  53 +-
>  net/unix/af_unix.h                          |  11 +-
>  scripts/syscall.tbl                         |  20 +
>  security/apparmor/file.c                    |   8 +-
>  security/integrity/ima/ima_policy.c         |   8 +-
>  security/integrity/integrity_audit.c        |   6 +-
>  security/ipe/audit.c                        |  12 +-
>  security/keys/compat.c                      |   3 +
>  security/keys/internal.h                    |   3 +
>  security/keys/keyctl.c                      |  61 ++-
>  security/keys/persistent.c                  |  11 +-
>  security/keys/process_keys.c                |  36 +-
>  security/keys/request_key.c                 |  12 +-
>  security/selinux/selinuxfs.c                |   8 +-
>  security/selinux/ss/services.c              |   4 +-
>  tools/testing/selftests/Makefile            |   1 +
>  tools/testing/selftests/uid_r/.gitignore    |   1 +
>  tools/testing/selftests/uid_r/Makefile      |   6 +
>  tools/testing/selftests/uid_r/config        |   4 +
>  tools/testing/selftests/uid_r/uid_r_test.c  | 535 ++++++++++++++++++++
>  143 files changed, 4425 insertions(+), 605 deletions(-)
>  create mode 100644 Documentation/userspace-api/uid_r.rst
>  create mode 100644 include/linux/uuid_types.h
>  create mode 100644 include/uapi/linux/uidgid_r.h
>  create mode 100644 kernel/uidgid_r.c
>  create mode 100644 tools/testing/selftests/uid_r/.gitignore
>  create mode 100644 tools/testing/selftests/uid_r/Makefile
>  create mode 100644 tools/testing/selftests/uid_r/config
>  create mode 100644 tools/testing/selftests/uid_r/uid_r_test.c
>
>
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907