On 1/18/24 15:36, Alice Ryhl wrote: > diff --git a/rust/kernel/cred.rs b/rust/kernel/cred.rs > new file mode 100644 > index 000000000000..ccec77242dfd > --- /dev/null > +++ b/rust/kernel/cred.rs > @@ -0,0 +1,65 @@ > +// SPDX-License-Identifier: GPL-2.0 > + > +//! Credentials management. > +//! > +//! C header: [`include/linux/cred.h`](../../../../include/linux/cred.h) IIRC you can use `srctree/include/..` to avoid the `../..` madness. > +//! > +//! Reference: <https://www.kernel.org/doc/html/latest/security/credentials.html> > + > +use crate::{ > + bindings, > + types::{AlwaysRefCounted, Opaque}, > +}; > + > +/// Wraps the kernel's `struct cred`. > +/// > +/// # Invariants > +/// > +/// Instances of this type are always ref-counted, that is, a call to `get_cred` ensures that the > +/// allocation remains valid at least until the matching call to `put_cred`. > +#[repr(transparent)] > +pub struct Credential(Opaque<bindings::cred>); > + > +// SAFETY: By design, the only way to access a `Credential` is via an immutable reference or an > +// `ARef`. This means that the only situation in which a `Credential` can be accessed mutably is > +// when the refcount drops to zero and the destructor runs. It is safe for that to happen on any > +// thread, so it is ok for this type to be `Send`. IMO the only important part is that calling `drop`/`dec_ref` is OK from any thread. In general I think it might be a good idea to make `AlwaysRefCounted: Send + Sync`. But that is outside the scope of this patch. > +unsafe impl Send for Credential {} > + > +// SAFETY: It's OK to access `Credential` through shared references from other threads because > +// we're either accessing properties that don't change or that are properly synchronised by C code. > +unsafe impl Sync for Credential {} > + > +impl Credential { > + /// Creates a reference to a [`Credential`] from a valid pointer. > + /// > + /// # Safety > + /// > + /// The caller must ensure that `ptr` is valid and remains valid for the lifetime of the > + /// returned [`Credential`] reference. > + pub unsafe fn from_ptr<'a>(ptr: *const bindings::cred) -> &'a Credential { > + // SAFETY: The safety requirements guarantee the validity of the dereference, while the > + // `Credential` type being transparent makes the cast ok. > + unsafe { &*ptr.cast() } > + } > + > + /// Returns the effective UID of the given credential. > + pub fn euid(&self) -> bindings::kuid_t { > + // SAFETY: By the type invariant, we know that `self.0` is valid. Is `euid` an immutable property, or why does this memory access not race with something? -- Cheers, Benno > + unsafe { (*self.0.get()).euid } > + } > +} > + > +// SAFETY: The type invariants guarantee that `Credential` is always ref-counted. > +unsafe impl AlwaysRefCounted for Credential { > + fn inc_ref(&self) { > + // SAFETY: The existence of a shared reference means that the refcount is nonzero. > + unsafe { bindings::get_cred(self.0.get()) }; > + } > + > + unsafe fn dec_ref(obj: core::ptr::NonNull<Credential>) { > + // SAFETY: The safety requirements guarantee that the refcount is nonzero. The cast is okay > + // because `Credential` has the same representation as `struct cred`. > + unsafe { bindings::put_cred(obj.cast().as_ptr()) }; > + } > +}
