From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=173.212.254.19 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792552532; b=eQ3v06dopNoOMyXcFUw60qhEIp5U0NVon1Vj94N1HsAdrHmrqsCOU6Ijt7n08CB0u02a mFegY639Rk0mJyvZsPTFefjpXsGY43IEk//A4OiygO+nMB0/KlsX4lRypZ1LfBbUPjC5h K2MIqe+kDNWCFhYV3CoNPClLTpZOKe/ufNeJJ0GRIT7TIHhk6JakyXDKKGVqpilAVRbNt KhlpUYbUgK/HwhZ2LT3BKg3Rk9INJC/p9reUlu5VmS4LhDS/mCtuVwhnxL1p+7em6vzQ/ a73MTw/dVvOTDhiQGfRluWqfykmnW/pFhDn8PZxPXgy4psayQXnoSkEpAUZz91xo0NQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792552532; h=DMARC-Filter:DKIM-Signature:Received:Message-ID:From:Subject:To:Cc: Date; bh=YaduMzvfjUgcifjx1pi5ZK/cl1FkRShsaWcEKnnQ8Pg=; b=Obn1toKIh+R4MyHi5VOYdf21ypVxyqxm6v9WngxgQdoWc7u45e+7dPE0fuQBlNKFThIN BetZQZT0Gm9dn2z93DxHLOyv6szMb/77u+Xmhdyyyryi8mdaycjS5KWzzDip1voMhojSq hOGS07eZo+isyh0nYUWAyGnuDDr6h2Ztk0Lo1XfKxfBdmqVwHpuGPbEbvsGEjx5X+Wgr4 QyAUvzzn3B+9kY0wbryHfhx+2d2RwadaSKRSss3qOIDzUjB+eHhYhTSMxMwXX8CuUo1HH jbCl0qr7C5k3ejs/Vi2dV0ir85Gf/vyCzfHBaWNW4+CExZilCIqSuu9d81G9ywtuMdw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=tuxist.de; spf=fail smtp.mailfrom=tuxist.de; dkim=pass header.d=tuxist.de header.i=@tuxist.de header.a=rsa-sha256 header.s=201705 header.b=KgTgupxp; arc=none smtp.remote-ip=173.212.254.19 Received: from groupware.tuxist.de (groupware.tuxist.de [173.212.254.19]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14D3E606A31C; Wed, 21 Oct 2026 03:15:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 14D3E606A31C Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=tuxist.de Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=tuxist.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=tuxist.de header.i=@tuxist.de header.a=rsa-sha256 header.s=201705 header.b=KgTgupxp DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tuxist.de; s=201705; t=1792552521; bh=5RQb5oh7C6Ufck1Z8Xc+OXN3xG3LP8fAQhoU212huu4=; h=From:Subject:To:Cc:Date:From; b=KgTgupxpKG12s5mz/k1GL4Lo4NtxEXAFnOLiMS2BVnrsjrcYcRNI5cPvr58+4eOP2 WSIa6ENPqJF294jDtExHJ7DGUwc9xDKOR9OS6y4N02QiD9sTRHRkxhhkPaNXXboP0Q 33Guwue2+NIguVjhBYY1JFKMCjjRkowsx+/vSM7tR7BLv+kUqaIH1GbgM7B5QRf8AG oUhOaUGPIzUpcQ2NsLSPxFM3MN7C1cp9QU30WQy6nEE5fckaMjH7MLMIY3kBVtvwfo UOX/spOTQO8/4eNsg0tm/isQqLPmW3GgedcDbXvaPwnBU9J/SrROV9RgAZPNhRpcvs 6AdDnNTSr8nFw== Received: from [10.1.1.106] (unknown [10.1.2.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by groupware.tuxist.de (Postfix) with ESMTPSA id 9249A8A0651; Wed, 21 Oct 2026 05:15:20 +0200 (CEST) Message-ID: From: Jan Koester Subject: [RFC PATCH v2 00/41] UUID and GUID user and group ids (*_r system calls) To: Christian Brauner , Alexander Viro , "Serge E. Hallyn" Cc: Jan Kara , "Theodore Y. Ts'o" , Paul Moore , Arnd Bergmann , linux-fsdevel@vger.kernel.org, linux-api@vger.kernel.org, linux-security-module@vger.kernel.org, linux-arch@vger.kernel.org, linux-ext4@vger.kernel.org, linux-nfs@vger.kernel.org, linux-cifs@vger.kernel.org, netdev@vger.kernel.org, audit@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 21 Oct 2026 05:15:20 +0200 X-Mailing-List: netdev@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Hi, this RFC series lets a user or group id be a UUID (RFC 9562, version 4) or a Microsoft GUID as well as a classic 32-bit number. Processes can run as such a user, files can be owned by one, and credentials, ACLs, keys, System V IPC, sockets, signals, audit and procfs carry the whole id. Why --- Directory services name users by 128-bit ids: Active Directory by objectGUID (and SIDs), LDAP directories often by entryUUID. Today every system that serves such users (winbind, sssd, nfsidmap, ksmbd user space) maps them to 32-bit numbers through ranges, hashes or a local database. The numbers differ between machines unless the mapping is configured the same everywhere, mappings can collide, and ownership written to shared storage or a backup depends on the machine that wrote it. With the 128-bit id in the kernel, the id the directory hands out is also the owner on disk and in every credential, and no mapping table is needed. Design ------ - kuid_t and kgid_t become a tagged union (legacy number, UUID, GUID) instead of a u32. There is no table that maps UUIDs to numbers: the kernel compares, hashes and stores the whole id. uid_eq(), uid_lt() and the other helpers keep their meaning. Patches 1-3 add the UAPI type and helpers. Patches 4-8 fix places that relied on kuid_t being a u32: sk_uid is now read through a seqcount, and af_unix, netlink and Bluetooth keep only classic ids in skb->cb. Patch 9 changes the type. - UUIDs and GUIDs exist only in the initial user namespace. They are not part of any uid_map or gid_map, show as the overflow id in other namespaces, and no capability in a child namespace gives privilege over them. Idmapped mounts pass them through unchanged. - The classic system calls keep their 32-bit ids and show a UUID or GUID as the overflow id, as the 16-bit calls do for ids above 65535. A new family, named after the old calls with an _r suffix (getuid_r, setresuid_r, setgroups_r, fchownat_r, ...), takes a 20-byte __kernel_uid_r_t: typedef struct __kernel_uid_r { __u32 type; /* UID_R_NONE, _LEGACY, _UUID, _GUID */ union { __u32 legacy; __u8 uuid[16]; __u8 guid[16]; }; } __kernel_uid_r_t; It has the same layout on every ABI, so none of the calls needs a compat entry. - Existing interfaces get _R variants where an id is in the ABI: STATX_UID_R/STATX_GID_R, SO_PEERCRED_R, SO_PEERGROUPS_R, SCM_CREDENTIALS_R, si_uid_r in siginfo (offset 96 in every layout), IPC_STAT_R/IPC_SET_R, KEYCTL_CHOWN_R, and version 3 of the POSIX ACL xattr. procfs, audit records, key descriptions and the RPCSEC_GSS upcall use a text form (decimal, UUID, or GUID in braces). - A filesystem has to declare that it can store such owners (SB_I_UID_R). Everywhere else, chown and creating a file as such a user fail with EOVERFLOW, so a UUID never turns into a wrong number on disk. tmpfs, ramfs and devpts declare it, overlayfs does when its upper layer does, and ext4 does with a new read-only compatible feature, uid_r (patches 31, 32 and 34; 256-byte inodes). NFSv4 and ksmbd carry the ids as text or as SIDs (S-1-22-3/4/5/6-...). - Things that can't carry a 128-bit id fail closed instead of mapping: quotas don't account such owners, AUTH_SYS sends the overflow id, unprivileged ublk devices are refused, and gssd versions that don't know uid_r= refuse the upcall. Documentation/userspace-api/uid_r.rst (patches 35 and 41) describes the whole ABI and its limitations. Testing ------- - tools/testing/selftests/uid_r (patch 36): 14/14 pass. - A boot test suite (nolibc init on QEMU, ext4 images with and without uid_r): 88/88 pass, on a kernel with USER_NS, overlayfs, tmpfs, POSIX ACLs and audit enabled. - End to end on a full distribution (FenrirOS: patched libc, e2fsprogs, OpenSSH, rsync, libarchive, a ksmbd and NFS server): UUID users log in over ssh, own files on ext4, and reach ksmbd and NFSv4 shares. - The selftests and the boot test suite ran on the same series on top of v7.2.9 and v7.2.11. On v7.3-rc7, the series is built for x86_64 (bzImage and modules, with USER_NS, audit, ecryptfs, fscrypt, quota, ublk, NFS, Bluetooth and the LSMs enabled) and boots in QEMU, where an integration test with a full user space passes 24/24: ssh sessions with a pty as UUID users, UUID owners on tmpfs and overlayfs, SMB logins of UUID users through ksmbd with S-1-22-3-... owner SIDs, and NFSv4 showing and setting UUID owners. ext4 uid_r was not part of it. - The syscall tables of the other architectures are wired up (patch 22) but haven't been built. The e2fsprogs changes (mke2fs/tune2fs -O uid_r, e2fsck, debugfs, ACL conversion in libext2fs) will be sent to linux-ext4 separately. Open questions -------------- - Is a tagged union in kuid_t acceptable, or would you rather see the 128-bit id kept beside a u32 kuid_t? - The new calls copy the classic get/set*id() and chown() families one by one (20 entries). A single setid_r(which, ...) call would need fewer syscall numbers. Which do you prefer? - Should the series be split per subsystem (core/uidgid, fs and VFS, net, ext4, nfsd/ksmbd) after this RFC? Changes in v2: - No code changes. v1 reached the lists only up to patch 11, the mail provider throttled the rest; this is the complete series, now sent from jan.koester@tuxist.de (author and Signed-off-by changed to it). - Hunk offsets refreshed against v7.3-rc7, testing section updated. - v1: https://lore.kernel.org/r/cover.1792346472.git.jan.koester@gmx.net The series is based on v7.3-rc7. The syscall numbers (473-492 on most architectures) are placeholders and will follow whatever is merged first. Jan Koester (41): uuid: move uuid_t and guid_t into uapi: add for 128 bit capable user and group ids uidgid: add uid_is_legacy() and gid_is_legacy() net: sock: read sk_uid through a seqcount af_unix: keep sender ids in skb->cb only when they are classic ids netlink: keep classic sender ids in skb->cb Bluetooth: keep classic sender ids in skb->cb smb: client: use __kuid_val() for the unix SIDs of the caller uidgid: let kuid_t and kgid_t hold a UUID or a GUID uidgid: convert between kernel ids and the ids of the *_r system calls fscrypt: show the whole uid in the description of user key claims keys: name per-user keyrings of UUID and GUID users by the whole uid ublk: refuse unprivileged devices to UUID and GUID users nfsd: don't hand out uid 0 for read layouts of UUID-owned files SUNRPC: name UUID and GUID users to gssd as uid_r= ecryptfs: hash daemons by kuid_hash() quota: don't account UUID and GUID owners fs: keep UUID and GUID owners off filesystems that can't store them cred: add the *_r variants of the get/set*id() system calls groups: add getgroups_r() and setgroups_r() fs: add chown_r(), lchown_r(), fchown_r() and fchownat_r() arch: wire up the *_r uid and gid system calls statx: report UUID and GUID owners shmem, ramfs: allow UUID and GUID owners uidgid: parse and print ids in their text form proc: show UUID and GUID ids in status, accept them for loginuid audit: log UUID and GUID ids in full net: add SO_PEERCRED_R, SO_PEERGROUPS_R and SCM_CREDENTIALS_R signal: report the sender's UUID or GUID uid in si_uid_r ipc: add IPC_STAT_R and IPC_SET_R ext4: add the uid_r feature for UUID and GUID owners ext4: let uid_r be turned on while the filesystem is mounted posix_acl: support UUID and GUID entries ext4: store ACLs with UUID and GUID entries on uid_r filesystems Documentation: describe UUID and GUID user and group ids selftests: add tests for UUID and GUID ids ovl: allow UUID and GUID owners when the upper layer does devpts: allow UUID and GUID owners ksmbd: log in UUID and GUID users and map them to SIDs nfsd, nfs: carry UUID and GUID owners as their text form Documentation: uid_r: describe SMB and NFSv4 Documentation/userspace-api/index.rst | 1 + Documentation/userspace-api/uid_r.rst | 186 +++++++ arch/alpha/include/uapi/asm/socket.h | 5 + arch/alpha/kernel/syscalls/syscall.tbl | 20 + arch/arm/tools/syscall.tbl | 20 + arch/arm64/tools/syscall_32.tbl | 20 + arch/m68k/kernel/syscalls/syscall.tbl | 20 + arch/microblaze/kernel/syscalls/syscall.tbl | 20 + arch/mips/include/uapi/asm/socket.h | 5 + arch/mips/kernel/syscalls/syscall_n32.tbl | 20 + arch/mips/kernel/syscalls/syscall_n64.tbl | 20 + arch/mips/kernel/syscalls/syscall_o32.tbl | 20 + arch/parisc/include/uapi/asm/socket.h | 5 + arch/parisc/kernel/syscalls/syscall.tbl | 20 + arch/powerpc/kernel/syscalls/syscall.tbl | 20 + arch/s390/kernel/syscalls/syscall.tbl | 20 + arch/sh/kernel/syscalls/syscall.tbl | 20 + arch/sparc/include/uapi/asm/socket.h | 5 + arch/sparc/kernel/syscalls/syscall.tbl | 20 + arch/x86/entry/syscalls/syscall_32.tbl | 20 + arch/x86/entry/syscalls/syscall_64.tbl | 20 + arch/xtensa/kernel/syscalls/syscall.tbl | 20 + drivers/block/ublk_drv.c | 17 +- drivers/tty/tty_audit.c | 7 +- fs/attr.c | 7 + fs/crypto/keyring.c | 7 +- fs/devpts/inode.c | 2 + fs/ecryptfs/messaging.c | 2 +- fs/ext4/acl.c | 109 +++- fs/ext4/acl.h | 34 +- fs/ext4/ext4.h | 27 +- fs/ext4/inode.c | 115 ++++- fs/ext4/ioctl.c | 30 +- fs/ext4/super.c | 45 +- fs/mnt_idmapping.c | 14 + fs/nfs/nfs4idmap.c | 53 ++ fs/nfs/super.c | 2 + fs/nfsd/flexfilelayout.c | 6 +- fs/nfsd/nfs4idmap.c | 68 ++- fs/open.c | 144 +++++- fs/overlayfs/super.c | 3 + fs/posix_acl.c | 123 ++++- fs/proc/array.c | 17 +- fs/proc/base.c | 38 +- fs/quota/dquot.c | 3 + fs/ramfs/inode.c | 1 + fs/signalfd.c | 3 + fs/smb/client/cifsacl.c | 2 +- fs/smb/client/smb2pdu.c | 7 +- fs/smb/server/ksmbd_netlink.h | 15 +- fs/smb/server/mgmt/user_config.c | 35 +- fs/smb/server/mgmt/user_config.h | 4 +- fs/smb/server/smb2pdu.c | 10 +- fs/smb/server/smb_common.c | 18 +- fs/smb/server/smbacl.c | 178 +++++-- fs/smb/server/smbacl.h | 19 +- fs/smb/server/transport_ipc.c | 4 +- fs/smb/server/vfs_cache.c | 9 +- fs/smb/server/vfs_cache.h | 4 +- fs/stat.c | 24 +- include/linux/audit.h | 8 +- include/linux/compat.h | 6 + include/linux/fs.h | 29 +- include/linux/fs/super_types.h | 1 + include/linux/mnt_idmapping.h | 74 ++- include/linux/netlink.h | 2 +- include/linux/posix_acl_xattr.h | 31 ++ include/linux/ptrace.h | 2 +- include/linux/quota.h | 18 + include/linux/signal.h | 22 + include/linux/signal_types.h | 5 +- include/linux/socket.h | 1 + include/linux/syscalls.h | 44 ++ include/linux/uidgid.h | 165 +++++- include/linux/uidgid_types.h | 32 +- include/linux/uuid.h | 11 +- include/linux/uuid_types.h | 21 + include/net/bluetooth/bluetooth.h | 2 +- include/net/scm.h | 28 + include/net/sock.h | 32 +- include/uapi/asm-generic/siginfo.h | 17 + include/uapi/asm-generic/socket.h | 5 + include/uapi/asm-generic/unistd.h | 43 +- include/uapi/linux/ipc.h | 17 + include/uapi/linux/keyctl.h | 1 + include/uapi/linux/posix_acl_xattr.h | 19 + include/uapi/linux/signalfd.h | 4 +- include/uapi/linux/socket.h | 9 + include/uapi/linux/stat.h | 10 +- include/uapi/linux/uidgid_r.h | 45 ++ io_uring/waitid.c | 32 +- io_uring/waitid.h | 1 + ipc/mqueue.c | 4 +- ipc/msg.c | 40 +- ipc/sem.c | 31 +- ipc/shm.c | 32 +- ipc/util.c | 112 +++- ipc/util.h | 23 +- kernel/Makefile | 1 + kernel/audit.c | 50 +- kernel/audit.h | 4 +- kernel/auditsc.c | 63 ++- kernel/exit.c | 18 +- kernel/exit.h | 3 + kernel/groups.c | 94 +++- kernel/signal.c | 48 +- kernel/sys.c | 472 ++++++++++++----- kernel/sys_ni.c | 12 + kernel/ucount.c | 2 +- kernel/uidgid_r.c | 467 +++++++++++++++++ kernel/user.c | 2 +- kernel/user_namespace.c | 10 +- lib/kobject_uevent.c | 8 +- mm/oom_kill.c | 2 +- mm/shmem.c | 2 + net/bluetooth/hci_sock.c | 8 +- net/core/dev.c | 8 +- net/core/scm.c | 94 ++-- net/core/sock.c | 90 +++- net/netlabel/netlabel_user.c | 4 +- net/netlink/af_netlink.c | 4 +- net/socket.c | 5 +- net/sunrpc/auth_gss/auth_gss.c | 44 +- net/unix/af_unix.c | 53 +- net/unix/af_unix.h | 11 +- scripts/syscall.tbl | 20 + security/apparmor/file.c | 8 +- security/integrity/ima/ima_policy.c | 8 +- security/integrity/integrity_audit.c | 6 +- security/ipe/audit.c | 12 +- security/keys/compat.c | 3 + security/keys/internal.h | 3 + security/keys/keyctl.c | 61 ++- security/keys/persistent.c | 11 +- security/keys/process_keys.c | 36 +- security/keys/request_key.c | 12 +- security/selinux/selinuxfs.c | 8 +- security/selinux/ss/services.c | 4 +- tools/testing/selftests/Makefile | 1 + tools/testing/selftests/uid_r/.gitignore | 1 + tools/testing/selftests/uid_r/Makefile | 6 + tools/testing/selftests/uid_r/config | 4 + tools/testing/selftests/uid_r/uid_r_test.c | 535 ++++++++++++++++++++ 143 files changed, 4425 insertions(+), 605 deletions(-) create mode 100644 Documentation/userspace-api/uid_r.rst create mode 100644 include/linux/uuid_types.h create mode 100644 include/uapi/linux/uidgid_r.h create mode 100644 kernel/uidgid_r.c create mode 100644 tools/testing/selftests/uid_r/.gitignore create mode 100644 tools/testing/selftests/uid_r/Makefile create mode 100644 tools/testing/selftests/uid_r/config create mode 100644 tools/testing/selftests/uid_r/uid_r_test.c base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 -- 2.56.0