Skip to content

Commit e49d174

Browse files
wedsonaffbq
authored andcommitted
rust: cred: add Rust abstraction for struct cred
Add a wrapper around `struct cred` called `Credential`, and provide functionality to get the `Credential` associated with a `File`. Rust Binder must check the credentials of processes when they attempt to perform various operations, and these checks usually take a `&Credential` as parameter. The security_binder_set_context_mgr function would be one example. This patch is necessary to access these security_* methods from Rust. Signed-off-by: Wedson Almeida Filho <[email protected]> Co-developed-by: Alice Ryhl <[email protected]> Reviewed-by: Trevor Gross <[email protected]> Reviewed-by: Benno Lossin <[email protected]> Reviewed-by: Martin Rodriguez Reboredo <[email protected]> Signed-off-by: Alice Ryhl <[email protected]> Link: https://lore.kernel.org/r/[email protected]
1 parent eda3c23 commit e49d174

File tree

5 files changed

+102
-0
lines changed

5 files changed

+102
-0
lines changed

rust/bindings/bindings_helper.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
*/
88

99
#include <kunit/test.h>
10+
#include <linux/cred.h>
1011
#include <linux/errname.h>
1112
#include <linux/ethtool.h>
1213
#include <linux/file.h>

rust/helpers.c

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
#include <kunit/test-bug.h>
2424
#include <linux/bug.h>
2525
#include <linux/build_bug.h>
26+
#include <linux/cred.h>
2627
#include <linux/err.h>
2728
#include <linux/errname.h>
2829
#include <linux/fs.h>
@@ -164,6 +165,18 @@ struct file *rust_helper_get_file(struct file *f)
164165
}
165166
EXPORT_SYMBOL_GPL(rust_helper_get_file);
166167

168+
const struct cred *rust_helper_get_cred(const struct cred *cred)
169+
{
170+
return get_cred(cred);
171+
}
172+
EXPORT_SYMBOL_GPL(rust_helper_get_cred);
173+
174+
void rust_helper_put_cred(const struct cred *cred)
175+
{
176+
put_cred(cred);
177+
}
178+
EXPORT_SYMBOL_GPL(rust_helper_put_cred);
179+
167180
/*
168181
* `bindgen` binds the C `size_t` type as the Rust `usize` type, so we can
169182
* use it in contexts where Rust expects a `usize` like slice (array) indices.

rust/kernel/cred.rs

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
3+
//! Credentials management.
4+
//!
5+
//! C header: [`include/linux/cred.h`](srctree/include/linux/cred.h).
6+
//!
7+
//! Reference: <https://www.kernel.org/doc/html/latest/security/credentials.html>
8+
9+
use crate::{
10+
bindings,
11+
types::{AlwaysRefCounted, Opaque},
12+
};
13+
14+
/// Wraps the kernel's `struct cred`.
15+
///
16+
/// Credentials are used for various security checks in the kernel.
17+
///
18+
/// Most fields of credentials are immutable. When things have their credentials changed, that
19+
/// happens by replacing the credential instead of changing an existing credential. See the [kernel
20+
/// documentation][ref] for more info on this.
21+
///
22+
/// # Invariants
23+
///
24+
/// Instances of this type are always ref-counted, that is, a call to `get_cred` ensures that the
25+
/// allocation remains valid at least until the matching call to `put_cred`.
26+
///
27+
/// [ref]: https://www.kernel.org/doc/html/latest/security/credentials.html
28+
#[repr(transparent)]
29+
pub struct Credential(Opaque<bindings::cred>);
30+
31+
// SAFETY:
32+
// - `Credential::dec_ref` can be called from any thread.
33+
// - It is okay to send ownership of `Credential` across thread boundaries.
34+
unsafe impl Send for Credential {}
35+
36+
// SAFETY: It's OK to access `Credential` through shared references from other threads because
37+
// we're either accessing properties that don't change or that are properly synchronised by C code.
38+
unsafe impl Sync for Credential {}
39+
40+
impl Credential {
41+
/// Creates a reference to a [`Credential`] from a valid pointer.
42+
///
43+
/// # Safety
44+
///
45+
/// The caller must ensure that `ptr` is valid and remains valid for the lifetime of the
46+
/// returned [`Credential`] reference.
47+
pub unsafe fn from_ptr<'a>(ptr: *const bindings::cred) -> &'a Credential {
48+
// SAFETY: The safety requirements guarantee the validity of the dereference, while the
49+
// `Credential` type being transparent makes the cast ok.
50+
unsafe { &*ptr.cast() }
51+
}
52+
53+
/// Returns the effective UID of the given credential.
54+
pub fn euid(&self) -> bindings::kuid_t {
55+
// SAFETY: By the type invariant, we know that `self.0` is valid. Furthermore, the `euid`
56+
// field of a credential is never changed after initialization, so there is no potential
57+
// for data races.
58+
unsafe { (*self.0.get()).euid }
59+
}
60+
}
61+
62+
// SAFETY: The type invariants guarantee that `Credential` is always ref-counted.
63+
unsafe impl AlwaysRefCounted for Credential {
64+
fn inc_ref(&self) {
65+
// SAFETY: The existence of a shared reference means that the refcount is nonzero.
66+
unsafe { bindings::get_cred(self.0.get()) };
67+
}
68+
69+
unsafe fn dec_ref(obj: core::ptr::NonNull<Credential>) {
70+
// SAFETY: The safety requirements guarantee that the refcount is nonzero. The cast is okay
71+
// because `Credential` has the same representation as `struct cred`.
72+
unsafe { bindings::put_cred(obj.cast().as_ptr()) };
73+
}
74+
}

rust/kernel/file.rs

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
88
use crate::{
99
bindings,
10+
cred::Credential,
1011
error::{code::*, Error, Result},
1112
types::{ARef, AlwaysRefCounted, Opaque},
1213
};
@@ -207,6 +208,18 @@ impl File {
207208
self.0.get()
208209
}
209210

211+
/// Returns the credentials of the task that originally opened the file.
212+
pub fn cred(&self) -> &Credential {
213+
// SAFETY: It's okay to read the `f_cred` field without synchronization because `f_cred` is
214+
// never changed after initialization of the file.
215+
let ptr = unsafe { (*self.as_ptr()).f_cred };
216+
217+
// SAFETY: The signature of this function ensures that the caller will only access the
218+
// returned credential while the file is still valid, and the C side ensures that the
219+
// credential stays valid at least as long as the file.
220+
unsafe { Credential::from_ptr(ptr) }
221+
}
222+
210223
/// Returns the flags associated with the file.
211224
///
212225
/// The flags are a combination of the constants in [`flags`].

rust/kernel/lib.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ extern crate self as kernel;
3131
#[cfg(not(testlib))]
3232
mod allocator;
3333
mod build_assert;
34+
pub mod cred;
3435
pub mod error;
3536
pub mod file;
3637
pub mod init;

0 commit comments

Comments
 (0)