1 // SPDX-License-Identifier: GPL-2.0 2 3 // Copyright (C) 2024 Google LLC. 4 5 //! Credentials management. 6 //! 7 //! C header: [`include/linux/cred.h`](srctree/include/linux/cred.h). 8 //! 9 //! Reference: <https://www.kernel.org/doc/html/latest/security/credentials.html> 10 11 use crate::{bindings, sync::aref::AlwaysRefCounted, task::Kuid, types::Opaque}; 12 13 /// Wraps the kernel's `struct cred`. 14 /// 15 /// Credentials are used for various security checks in the kernel. 16 /// 17 /// Most fields of credentials are immutable. When things have their credentials changed, that 18 /// happens by replacing the credential instead of changing an existing credential. See the [kernel 19 /// documentation][ref] for more info on this. 20 /// 21 /// # Invariants 22 /// 23 /// Instances of this type are always ref-counted, that is, a call to `get_cred` ensures that the 24 /// allocation remains valid at least until the matching call to `put_cred`. 25 /// 26 /// [ref]: https://www.kernel.org/doc/html/latest/security/credentials.html 27 #[repr(transparent)] 28 pub struct Credential(Opaque<bindings::cred>); 29 30 // SAFETY: 31 // - `Credential::dec_ref` can be called from any thread. 32 // - It is okay to send ownership of `Credential` across thread boundaries. 33 unsafe impl Send for Credential {} 34 35 // SAFETY: It's OK to access `Credential` through shared references from other threads because 36 // we're either accessing properties that don't change or that are properly synchronised by C code. 37 unsafe impl Sync for Credential {} 38 39 impl Credential { 40 /// Creates a reference to a [`Credential`] from a valid pointer. 41 /// 42 /// # Safety 43 /// 44 /// The caller must ensure that `ptr` is valid and remains valid for the lifetime of the 45 /// returned [`Credential`] reference. 46 #[inline] from_ptr<'a>(ptr: *const bindings::cred) -> &'a Credential47 pub unsafe fn from_ptr<'a>(ptr: *const bindings::cred) -> &'a Credential { 48 // SAFETY: The safety requirements guarantee the validity of the dereference, while the 49 // `Credential` type being transparent makes the cast ok. 50 unsafe { &*ptr.cast() } 51 } 52 53 /// Get the id for this security context. 54 #[inline] get_secid(&self) -> u3255 pub fn get_secid(&self) -> u32 { 56 let mut secid = 0; 57 // SAFETY: The invariants of this type ensures that the pointer is valid. 58 unsafe { bindings::security_cred_getsecid(self.0.get(), &mut secid) }; 59 secid 60 } 61 62 /// Returns the effective UID of the given credential. 63 #[inline] euid(&self) -> Kuid64 pub fn euid(&self) -> Kuid { 65 // SAFETY: By the type invariant, we know that `self.0` is valid. Furthermore, the `euid` 66 // field of a credential is never changed after initialization, so there is no potential 67 // for data races. 68 Kuid::from_raw(unsafe { (*self.0.get()).euid }) 69 } 70 } 71 72 // SAFETY: The type invariants guarantee that `Credential` is always ref-counted. 73 unsafe impl AlwaysRefCounted for Credential { 74 #[inline] inc_ref(&self)75 fn inc_ref(&self) { 76 // SAFETY: The existence of a shared reference means that the refcount is nonzero. 77 unsafe { bindings::get_cred(self.0.get()) }; 78 } 79 80 #[inline] dec_ref(obj: core::ptr::NonNull<Credential>)81 unsafe fn dec_ref(obj: core::ptr::NonNull<Credential>) { 82 // SAFETY: The safety requirements guarantee that the refcount is nonzero. The cast is okay 83 // because `Credential` has the same representation as `struct cred`. 84 unsafe { bindings::put_cred(obj.cast().as_ptr()) }; 85 } 86 } 87