[PATCH] rust: task: clarify comments on task UID accessors

[PATCH] rust: task: clarify comments on task UID accessors

[Jann Horn]

Linux has separate subjective and objective task credentials, see the
comment above `struct cred`. Clarify which accessor functions operate on
which set of credentials.

Also document that Task::euid() is a very weird operation. You can see how
weird it is by grepping for task_euid() - binder is its only user.
Task::euid() obtains the objective effective UID - it looks at the
credentials of the task for purposes of acting on it as an object, but then
accesses the effective UID (which the credentials.7 man page describes as
"[...] used by the kernel to determine the permissions that the process
will have when accessing shared resources [...]").

For context:
Arguably, binder's use of task_euid() is a theoretical security problem,
which only has no impact on Android because Android has no setuid binaries
executable by apps.
commit 29bc22ac5e5b ("binder: use euid from cred instead of using task")
fixed that by removing that only user of task_euid(), but the fix got
reverted in commit c21a80ca0684 ("binder: fix test regression due to
sender_euid change") because some Android test started failing.

Signed-off-by: Jann Horn <jannh@google.com>
---
 rust/kernel/task.rs | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs
index 49fad6de0674..33e6d44b9a15 100644
--- a/rust/kernel/task.rs
+++ b/rust/kernel/task.rs
@@ -223,14 +223,17 @@ pub fn pid(&self) -> Pid {
         unsafe { *ptr::addr_of!((*self.as_ptr()).pid) }
     }
 
-    /// Returns the UID of the given task.
+    /// Returns the objective real UID of the given task.
     #[inline]
     pub fn uid(&self) -> Kuid {
         // SAFETY: It's always safe to call `task_uid` on a valid task.
         Kuid::from_raw(unsafe { bindings::task_uid(self.as_ptr()) })
     }
 
-    /// Returns the effective UID of the given task.
+    /// Returns the objective effective UID of the given task.
+    ///
+    /// You should probably not be using this; the effective UID is normally
+    /// only relevant in subjective credentials.
     #[inline]
     pub fn euid(&self) -> Kuid {
         // SAFETY: It's always safe to call `task_euid` on a valid task.
@@ -363,7 +366,7 @@ unsafe fn dec_ref(obj: ptr::NonNull<Self>) {
 }
 
 impl Kuid {
-    /// Get the current euid.
+    /// Get the current subjective euid.
     #[inline]
     pub fn current_euid() -> Kuid {
         // SAFETY: Just an FFI call.

---
base-commit: 192c0159402e6bfbe13de6f8379546943297783d
change-id: 20260212-rust-uid-f1b3a45c8084

--  
Jann Horn <jannh@google.com>

Re: [PATCH] rust: task: clarify comments on task UID accessors

[Alice Ryhl]

On Thu, Feb 12, 2026 at 07:00:49PM +0100, Jann Horn wrote:
> Linux has separate subjective and objective task credentials, see the
> comment above `struct cred`. Clarify which accessor functions operate on
> which set of credentials.
> 
> Also document that Task::euid() is a very weird operation. You can see how
> weird it is by grepping for task_euid() - binder is its only user.
> Task::euid() obtains the objective effective UID - it looks at the
> credentials of the task for purposes of acting on it as an object, but then
> accesses the effective UID (which the credentials.7 man page describes as
> "[...] used by the kernel to determine the permissions that the process
> will have when accessing shared resources [...]").
> 
> For context:
> Arguably, binder's use of task_euid() is a theoretical security problem,
> which only has no impact on Android because Android has no setuid binaries
> executable by apps.
> commit 29bc22ac5e5b ("binder: use euid from cred instead of using task")
> fixed that by removing that only user of task_euid(), but the fix got
> reverted in commit c21a80ca0684 ("binder: fix test regression due to
> sender_euid change") because some Android test started failing.
> 
> Signed-off-by: Jann Horn <jannh@google.com>
> ---
>  rust/kernel/task.rs | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs
> index 49fad6de0674..33e6d44b9a15 100644
> --- a/rust/kernel/task.rs
> +++ b/rust/kernel/task.rs
> @@ -223,14 +223,17 @@ pub fn pid(&self) -> Pid {
>          unsafe { *ptr::addr_of!((*self.as_ptr()).pid) }
>      }
>  
> -    /// Returns the UID of the given task.
> +    /// Returns the objective real UID of the given task.
>      #[inline]
>      pub fn uid(&self) -> Kuid {
>          // SAFETY: It's always safe to call `task_uid` on a valid task.
>          Kuid::from_raw(unsafe { bindings::task_uid(self.as_ptr()) })
>      }
>  
> -    /// Returns the effective UID of the given task.
> +    /// Returns the objective effective UID of the given task.
> +    ///
> +    /// You should probably not be using this; the effective UID is normally
> +    /// only relevant in subjective credentials.
>      #[inline]
>      pub fn euid(&self) -> Kuid {

Should this be renamed if it's a weird operation?

Alice

Re: [PATCH] rust: task: clarify comments on task UID accessors

[Gary Guo]

On Fri Feb 13, 2026 at 2:00 AM CST, Jann Horn wrote:
> Linux has separate subjective and objective task credentials, see the
> comment above `struct cred`. Clarify which accessor functions operate on
> which set of credentials.
>
> Also document that Task::euid() is a very weird operation. You can see how
> weird it is by grepping for task_euid() - binder is its only user.
> Task::euid() obtains the objective effective UID - it looks at the
> credentials of the task for purposes of acting on it as an object, but then
> accesses the effective UID (which the credentials.7 man page describes as
> "[...] used by the kernel to determine the permissions that the process
> will have when accessing shared resources [...]").
>
> For context:
> Arguably, binder's use of task_euid() is a theoretical security problem,
> which only has no impact on Android because Android has no setuid binaries
> executable by apps.

If there's no setuid binary, then the `task_euid` can also just be replaced with
`task_uid`?

> commit 29bc22ac5e5b ("binder: use euid from cred instead of using task")
> fixed that by removing that only user of task_euid(), but the fix got
> reverted in commit c21a80ca0684 ("binder: fix test regression due to
> sender_euid change") because some Android test started failing.

What exactly is relying on the current behaviour? It'll better to fix that and
remove `task_euid` completely as I find "objective effective UID" quite
confusing, even with disclaimer that it shouldn't be used.

Best,
Gary


>
> Signed-off-by: Jann Horn <jannh@google.com>
> ---
>  rust/kernel/task.rs | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs
> index 49fad6de0674..33e6d44b9a15 100644
> --- a/rust/kernel/task.rs
> +++ b/rust/kernel/task.rs
> @@ -223,14 +223,17 @@ pub fn pid(&self) -> Pid {
>          unsafe { *ptr::addr_of!((*self.as_ptr()).pid) }
>      }
>  
> -    /// Returns the UID of the given task.
> +    /// Returns the objective real UID of the given task.
>      #[inline]
>      pub fn uid(&self) -> Kuid {
>          // SAFETY: It's always safe to call `task_uid` on a valid task.
>          Kuid::from_raw(unsafe { bindings::task_uid(self.as_ptr()) })
>      }
>  
> -    /// Returns the effective UID of the given task.
> +    /// Returns the objective effective UID of the given task.
> +    ///
> +    /// You should probably not be using this; the effective UID is normally
> +    /// only relevant in subjective credentials.
>      #[inline]
>      pub fn euid(&self) -> Kuid {
>          // SAFETY: It's always safe to call `task_euid` on a valid task.
> @@ -363,7 +366,7 @@ unsafe fn dec_ref(obj: ptr::NonNull<Self>) {
>  }
>  
>  impl Kuid {
> -    /// Get the current euid.
> +    /// Get the current subjective euid.
>      #[inline]
>      pub fn current_euid() -> Kuid {
>          // SAFETY: Just an FFI call.
>
> ---
> base-commit: 192c0159402e6bfbe13de6f8379546943297783d
> change-id: 20260212-rust-uid-f1b3a45c8084
>
> --  
> Jann Horn <jannh@google.com>

Re: [PATCH] rust: task: clarify comments on task UID accessors

[Jann Horn]

On Fri, Feb 13, 2026 at 9:20 AM Alice Ryhl <aliceryhl@google.com> wrote:
> On Thu, Feb 12, 2026 at 07:00:49PM +0100, Jann Horn wrote:
> > -    /// Returns the effective UID of the given task.
> > +    /// Returns the objective effective UID of the given task.
> > +    ///
> > +    /// You should probably not be using this; the effective UID is normally
> > +    /// only relevant in subjective credentials.
> >      #[inline]
> >      pub fn euid(&self) -> Kuid {
>
> Should this be renamed if it's a weird operation?

Hm, maybe? I have no opinion on that.

Re: [PATCH] rust: task: clarify comments on task UID accessors

[Jann Horn]

On Fri, Feb 13, 2026 at 9:53 AM Gary Guo <gary@garyguo.net> wrote:
> On Fri Feb 13, 2026 at 2:00 AM CST, Jann Horn wrote:
> > Linux has separate subjective and objective task credentials, see the
> > comment above `struct cred`. Clarify which accessor functions operate on
> > which set of credentials.
> >
> > Also document that Task::euid() is a very weird operation. You can see how
> > weird it is by grepping for task_euid() - binder is its only user.
> > Task::euid() obtains the objective effective UID - it looks at the
> > credentials of the task for purposes of acting on it as an object, but then
> > accesses the effective UID (which the credentials.7 man page describes as
> > "[...] used by the kernel to determine the permissions that the process
> > will have when accessing shared resources [...]").
> >
> > For context:
> > Arguably, binder's use of task_euid() is a theoretical security problem,
> > which only has no impact on Android because Android has no setuid binaries
> > executable by apps.
>
> If there's no setuid binary, then the `task_euid` can also just be replaced with
> `task_uid`?

That would still be wrong for binder's usecase though.

> > commit 29bc22ac5e5b ("binder: use euid from cred instead of using task")
> > fixed that by removing that only user of task_euid(), but the fix got
> > reverted in commit c21a80ca0684 ("binder: fix test regression due to
> > sender_euid change") because some Android test started failing.
>
> What exactly is relying on the current behaviour? It'll better to fix that and
> remove `task_euid` completely as I find "objective effective UID" quite
> confusing, even with disclaimer that it shouldn't be used.

I agree with that; I don't know what that failing test was. (Todd
would probably know.) My understanding is:

In the current version, the ->sender_euid reported to a transaction's
recipient is the EUID of the sending process *at the time the
transaction is received by the recipient*. (This is wrong if the
sending process changed credentials after sending the transaction, and
especially dangerous if the sending process went through a setuid
execution in the meantime.)

With the reverted fix, the ->sender_euid reported to the recipient was
the EUID of the sending process *when it opened /dev/binder*. (That is
secure, and capturing credentials at open() time is a standard
mechanism in Linux, but it might be surprising to userspace code that
calls seteuid() between opening /dev/binder and sending a transaction.
I guess that's probably what that failing test was about.)

Probably the right fix would be to capture the current_euid() in the
sending process when it sends a transaction.

Re: [PATCH] rust: task: clarify comments on task UID accessors

[Alice Ryhl]

On Fri, Feb 13, 2026 at 03:43:21PM +0100, Jann Horn wrote:
> On Fri, Feb 13, 2026 at 9:53 AM Gary Guo <gary@garyguo.net> wrote:
> > On Fri Feb 13, 2026 at 2:00 AM CST, Jann Horn wrote:
> > > Linux has separate subjective and objective task credentials, see the
> > > comment above `struct cred`. Clarify which accessor functions operate on
> > > which set of credentials.
> > >
> > > Also document that Task::euid() is a very weird operation. You can see how
> > > weird it is by grepping for task_euid() - binder is its only user.
> > > Task::euid() obtains the objective effective UID - it looks at the
> > > credentials of the task for purposes of acting on it as an object, but then
> > > accesses the effective UID (which the credentials.7 man page describes as
> > > "[...] used by the kernel to determine the permissions that the process
> > > will have when accessing shared resources [...]").
> > >
> > > For context:
> > > Arguably, binder's use of task_euid() is a theoretical security problem,
> > > which only has no impact on Android because Android has no setuid binaries
> > > executable by apps.
> >
> > If there's no setuid binary, then the `task_euid` can also just be replaced with
> > `task_uid`?
> 
> That would still be wrong for binder's usecase though.
> 
> > > commit 29bc22ac5e5b ("binder: use euid from cred instead of using task")
> > > fixed that by removing that only user of task_euid(), but the fix got
> > > reverted in commit c21a80ca0684 ("binder: fix test regression due to
> > > sender_euid change") because some Android test started failing.
> >
> > What exactly is relying on the current behaviour? It'll better to fix that and
> > remove `task_euid` completely as I find "objective effective UID" quite
> > confusing, even with disclaimer that it shouldn't be used.
> 
> I agree with that; I don't know what that failing test was. (Todd
> would probably know.) My understanding is:
> 
> In the current version, the ->sender_euid reported to a transaction's
> recipient is the EUID of the sending process *at the time the
> transaction is received by the recipient*. (This is wrong if the
> sending process changed credentials after sending the transaction, and
> especially dangerous if the sending process went through a setuid
> execution in the meantime.)
> 
> With the reverted fix, the ->sender_euid reported to the recipient was
> the EUID of the sending process *when it opened /dev/binder*. (That is
> secure, and capturing credentials at open() time is a standard
> mechanism in Linux, but it might be surprising to userspace code that
> calls seteuid() between opening /dev/binder and sending a transaction.
> I guess that's probably what that failing test was about.)
> 
> Probably the right fix would be to capture the current_euid() in the
> sending process when it sends a transaction.

We can certainly do that, but I don't know what the test failure was
either. And it should probably be changed for both drivers if so. I just
mirrored what C did.

Alice

Re: [PATCH] rust: task: clarify comments on task UID accessors

[Jann Horn]

On Fri, Feb 13, 2026 at 3:43 PM Jann Horn <jannh@google.com> wrote:
> I agree with that; I don't know what that failing test was. (Todd
> would probably know.) My understanding is:
>
> In the current version, the ->sender_euid reported to a transaction's
> recipient is the EUID of the sending process *at the time the
> transaction is received by the recipient*. (This is wrong if the
> sending process changed credentials after sending the transaction, and
> especially dangerous if the sending process went through a setuid
> execution in the meantime.)

Sorry, looks like I didn't read carefully enough when I was writing my
last mail, and I forgot the details since I last really looked at
this...
What I wrote above is wrong.

In current binder (both C and Rust versions), the ->sender_euid
reported to the recipient is the current EUID of the main thread of
the process that opened /dev/binder, recorded at the time the
transaction is sent.

In C binder, I believe there is no check that the thread actually
making the transaction is part of the process that opened /dev/binder;
Rust binder checks for this in get_current_thread().