From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D9CDEAE7; Sun, 15 Sep 2024 20:24:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1726431879; cv=none; b=Zgg9KXBnTus6B9EqzbhJD9biabcARbUcIHWWLLhZQPO/QtWe1lQxDgO7IisLr+Y+U07zSCVq1wOf9sWIh284vRMade7OmIb4y1jFgVw4lxw0h1rFMwBFSJrJJrxYPfJtVU+yYk7j2GkPu4vS/qwv15hr9aTHsrgmCyQK7sliMNA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1726431879; c=relaxed/simple; bh=F29wHTMOl2UoZimULwhaDRQ88yiU9IOuqXw6WDIs0bM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=r8j+vUTglhCQtPpovVOlbH6Om6sBxNFOuRawV8WG0E7scOx5FAdY/TmhZabxJva2Q8V4EL/7DCXLEVbf/5nBopW48Bu+nudF5rrNzp5FYet9OAocgLS2mfACJQPAY4Q1GLVMpXMbfMF0h2HnYMzqdXSHoT81VyzaN71dbeGXN7o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fxujmghc; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fxujmghc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F624C4CEC3; Sun, 15 Sep 2024 20:24:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1726431878; bh=F29wHTMOl2UoZimULwhaDRQ88yiU9IOuqXw6WDIs0bM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=fxujmghczhubiD5/ERDfHzzJ7Q7aWb3zgCzZ2j1ZUsFjX2xf3KRebbsUTLiO5ipNY WphGWJ28ew62deSVmyNvORdSelirXb1oiDfrGUY7dOBUPslDHcv8K+WIaq/YYeD0/g 3ycGYs8il1ayHFHl8gMi0Axh4LKmg95HExHdcCOYlP8zeQ5olDxnj6j6tSFiISOoL/ 0XzQYaYwYuUKplKC4eoOUkz/ITZHYwloRtMtwemlt/zYFSBMOC4/0mkZCyEm5fHt9Q 69GyuEMhzm5Ty7voFdngMTqL0uH9bHr9Y1c/ehbGPkHZWHcYaPWRdYe7xDK5FuVXtP lnOzW7sPQ/Phg== Date: Sun, 15 Sep 2024 13:24:38 -0700 From: Kees Cook To: Alice Ryhl Cc: Paul Moore , James Morris , "Serge E. Hallyn" , Miguel Ojeda , Christian Brauner , Alex Gaynor , Wedson Almeida Filho , Boqun Feng , Gary Guo , =?iso-8859-1?Q?Bj=F6rn?= Roy Baron , Benno Lossin , Andreas Hindborg , Peter Zijlstra , Alexander Viro , Greg Kroah-Hartman , Arve =?iso-8859-1?B?SGr4bm5lduVn?= , Todd Kjos , Martijn Coenen , Joel Fernandes , Carlos Llamas , Suren Baghdasaryan , Dan Williams , Matthew Wilcox , Thomas Gleixner , Daniel Xu , Martin Rodriguez Reboredo , Trevor Gross , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, rust-for-linux@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: Re: [PATCH v10 4/8] rust: cred: add Rust abstraction for `struct cred` Message-ID: <202409151318.7985B253@keescook> References: <20240915-alice-file-v10-0-88484f7a3dcf@google.com> <20240915-alice-file-v10-4-88484f7a3dcf@google.com> Precedence: bulk X-Mailing-List: rust-for-linux@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240915-alice-file-v10-4-88484f7a3dcf@google.com> On Sun, Sep 15, 2024 at 02:31:30PM +0000, Alice Ryhl wrote: > From: Wedson Almeida Filho > > Add a wrapper around `struct cred` called `Credential`, and provide > functionality to get the `Credential` associated with a `File`. > > Rust Binder must check the credentials of processes when they attempt to > perform various operations, and these checks usually take a > `&Credential` as parameter. The security_binder_set_context_mgr function > would be one example. This patch is necessary to access these security_* > methods from Rust. > > This Rust abstraction makes the following assumptions about the C side: > * `struct cred` is refcounted with `get_cred`/`put_cred`. Yes > * It's okay to transfer a `struct cred` across threads, that is, you do > not need to call `put_cred` on the same thread as where you called > `get_cred`. Yes > * The `euid` field of a `struct cred` never changes after > initialization. "after initialization", yes. The bprm cred during exec is special in that it gets updated (bprm_fill_uid) before it is installed into current via commit_creds() in begin_new_exec() (the point of no return for exec). > * The `f_cred` field of a `struct file` never changes after > initialization. Yes. > > Signed-off-by: Wedson Almeida Filho > Co-developed-by: Alice Ryhl > Reviewed-by: Trevor Gross > Reviewed-by: Benno Lossin > Reviewed-by: Martin Rodriguez Reboredo > Reviewed-by: Gary Guo > Signed-off-by: Alice Ryhl Reviewed-by: Kees Cook -- Kees Cook