aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux/sched.h
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2008-11-13 18:39:26 -0500
committerJames Morris <jmorris@namei.org>2008-11-13 18:39:26 -0500
commit3b11a1decef07c19443d24ae926982bc8ec9f4c0 (patch)
treeb6555f0e5b07f4b2badd332a0a900b974920c49d /include/linux/sched.h
parent98870ab0a5a3f1822aee681d2997017e1c87d026 (diff)
CRED: Differentiate objective and effective subjective credentials on a task
Differentiate the objective and real subjective credentials from the effective subjective credentials on a task by introducing a second credentials pointer into the task_struct. task_struct::real_cred then refers to the objective and apparent real subjective credentials of a task, as perceived by the other tasks in the system. task_struct::cred then refers to the effective subjective credentials of a task, as used by that task when it's actually running. These are not visible to the other tasks in the system. __task_cred(task) then refers to the objective/real credentials of the task in question. current_cred() refers to the effective subjective credentials of the current task. prepare_creds() uses the objective creds as a base and commit_creds() changes both pointers in the task_struct (indeed commit_creds() requires them to be the same). override_creds() and revert_creds() change the subjective creds pointer only, and the former returns the old subjective creds. These are used by NFSD, faccessat() and do_coredump(), and will by used by CacheFiles. In SELinux, current_has_perm() is provided as an alternative to task_has_perm(). This uses the effective subjective context of current, whereas task_has_perm() uses the objective/real context of the subject. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'include/linux/sched.h')
-rw-r--r--include/linux/sched.h5
1 files changed, 4 insertions, 1 deletions
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 121d655e460d..3443123b0709 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1145,7 +1145,10 @@ struct task_struct {
1145 struct list_head cpu_timers[3]; 1145 struct list_head cpu_timers[3];
1146 1146
1147/* process credentials */ 1147/* process credentials */
1148 const struct cred *cred; /* actual/objective task credentials (COW) */ 1148 const struct cred *real_cred; /* objective and real subjective task
1149 * credentials (COW) */
1150 const struct cred *cred; /* effective (overridable) subjective task
1151 * credentials (COW) */
1149 struct mutex cred_exec_mutex; /* execve vs ptrace cred calculation mutex */ 1152 struct mutex cred_exec_mutex; /* execve vs ptrace cred calculation mutex */
1150 1153
1151 char comm[TASK_COMM_LEN]; /* executable name excluding path 1154 char comm[TASK_COMM_LEN]; /* executable name excluding path