Linux has separate subjective and objective task credentials, see the comment above `struct cred`. Clarify which accessor functions operate on which set of credentials. Also document that Task::euid() is a very weird operation. You can see how weird it is by grepping for task_euid() in the history - binder was its only user. Task::euid() obtains the objective effective UID - it looks at the credentials of the task for purposes of acting on it as an object, but then accesses the effective UID (which the credentials.7 man page describes as "[...] used by the kernel to determine the permissions that the process will have when accessing shared resources [...]"). For context: Arguably, binder's use of task_euid() is a theoretical security problem, which only has no impact on Android because Android has no setuid binaries executable by apps. commit 29bc22ac5e5b ("binder: use euid from cred instead of using task") originally fixed that by removing that only user of task_euid(), but the fix got reverted in commit c21a80ca0684 ("binder: fix test regression due to sender_euid change") because some Android test started failing. It was since fixed again by commit 65b672152289 ("binder: use current_euid() for transaction sender identity"), which uses current_euid() instead.
Unified · Split
| @@ -210,14 +210,17 @@ impl Task { · 209 unmodified lines | |||
| 210 | unsafe { *ptr::addr_of!((*self.as_ptr()).pid) } | 210 | unsafe { *ptr::addr_of!((*self.as_ptr()).pid) } |
| 211 | } | 211 | } |
| 212 | 212 | ||
| 213 | /// Returns the UID of the given task. | 213 | /// Returns the objective real UID of the given task. |
| 214 | #[inline] | 214 | #[inline] |
| 215 | pub fn uid(&self) -> Kuid { | 215 | pub fn uid(&self) -> Kuid { |
| 216 | // SAFETY: It's always safe to call `task_uid` on a valid task. | 216 | // SAFETY: It's always safe to call `task_uid` on a valid task. |
| 217 | Kuid::from_raw(unsafe { bindings::task_uid(self.as_ptr()) }) | 217 | Kuid::from_raw(unsafe { bindings::task_uid(self.as_ptr()) }) |
| 218 | } | 218 | } |
| 219 | 219 | ||
| 220 | /// Returns the effective UID of the given task. | 220 | /// Returns the objective effective UID of the given task. |
| 221 | /// | ||
| 222 | /// You should probably not be using this; the effective UID is normally | ||
| 223 | /// only relevant in subjective credentials. | ||
| 221 | #[inline] | 224 | #[inline] |
| 222 | pub fn euid(&self) -> Kuid { | 225 | pub fn euid(&self) -> Kuid { |
| 223 | // SAFETY: It's always safe to call `task_euid` on a valid task. | 226 | // SAFETY: It's always safe to call `task_euid` on a valid task. |
| @@ -371,7 +374,7 @@ impl PartialEq for Task { · 147 unmodified lines | |||
| 371 | impl Eq for Task {} | 374 | impl Eq for Task {} |
| 372 | 375 | ||
| 373 | impl Kuid { | 376 | impl Kuid { |
| 374 | /// Get the current euid. | 377 | /// Get the current subjective effective UID. |
| 375 | #[inline] | 378 | #[inline] |
| 376 | pub fn current_euid() -> Kuid { | 379 | pub fn current_euid() -> Kuid { |
| 377 | // SAFETY: Just an FFI call. | 380 | // SAFETY: Just an FFI call. |