Linux has separate subjective and objective task credentials, see the comment above `struct cred`. Clarify which accessor functions operate on which set of credentials. Also document that Task::euid() is a very weird operation. You can see how weird it is by grepping for task_euid() in the history - binder was its only user. Task::euid() obtains the objective effective UID - it looks at the credentials of the task for purposes of acting on it as an object, but then accesses the effective UID (which the credentials.7 man page describes as "[...] used by the kernel to determine the permissions that the process will have when accessing shared resources [...]"). For context: Arguably, binder's use of task_euid() is a theoretical security problem, which only has no impact on Android because Android has no setuid binaries executable by apps. commit 29bc22ac5e5b ("binder: use euid from cred instead of using task") originally fixed that by removing that only user of task_euid(), but the fix got reverted in commit c21a80ca0684 ("binder: fix test regression due to sender_euid change") because some Android test started failing. It was since fixed again by commit 65b672152289 ("binder: use current_euid() for transaction sender identity"), which uses current_euid() instead.
Showing the changes to rust/kernel (1 of 1 file). Show all
Unified · Split
| @@ -210,14 +210,17 @@ impl Task { · 209 unmodified lines | ||
| 210 | 210 | unsafe { *ptr::addr_of!((*self.as_ptr()).pid) } |
| 211 | 211 | } |
| 212 | 212 | |
| 213 | − /// Returns the UID of the given task. | |
| 213 | + /// Returns the objective real UID of the given task. | |
| 214 | 214 | #[inline] |
| 215 | 215 | pub fn uid(&self) -> Kuid { |
| 216 | 216 | // SAFETY: It's always safe to call `task_uid` on a valid task. |
| 217 | 217 | Kuid::from_raw(unsafe { bindings::task_uid(self.as_ptr()) }) |
| 218 | 218 | } |
| 219 | 219 | |
| 220 | − /// Returns the effective UID of the given task. | |
| 220 | + /// Returns the objective effective UID of the given task. | |
| 221 | + /// | |
| 222 | + /// You should probably not be using this; the effective UID is normally | |
| 223 | + /// only relevant in subjective credentials. | |
| 221 | 224 | #[inline] |
| 222 | 225 | pub fn euid(&self) -> Kuid { |
| 223 | 226 | // SAFETY: It's always safe to call `task_euid` on a valid task. |
| @@ -371,7 +374,7 @@ impl PartialEq for Task { · 147 unmodified lines | ||
| 371 | 374 | impl Eq for Task {} |
| 372 | 375 | |
| 373 | 376 | impl Kuid { |
| 374 | − /// Get the current euid. | |
| 377 | + /// Get the current subjective effective UID. | |
| 375 | 378 | #[inline] |
| 376 | 379 | pub fn current_euid() -> Kuid { |
| 377 | 380 | // SAFETY: Just an FFI call. |