Struct Credentials 

pub struct Credentials {

    pub uid: uid_t,
    pub gid: gid_t,
    pub euid: uid_t,
    pub egid: gid_t,
    pub saved_uid: uid_t,
    pub saved_gid: gid_t,
    pub groups: Vec<gid_t>,
    pub fsuid: uid_t,
    pub fsgid: gid_t,
    pub cap_permitted: Capabilities,
    pub cap_effective: Capabilities,
    pub cap_inheritable: Capabilities,
    pub cap_bounding: Capabilities,
    pub cap_ambient: Capabilities,
    pub securebits: SecureBits,
}

Fields

uid: uid_t

gid: gid_t

euid: uid_t

egid: gid_t

saved_uid: uid_t

saved_gid: gid_t

groups: Vec<gid_t>

fsuid: uid_t

See https://man7.org/linux/man-pages/man2/setfsuid.2.html

fsgid: gid_t

See https://man7.org/linux/man-pages/man2/setfsgid.2.html

cap_permitted: Capabilities

From https://man7.org/linux/man-pages/man7/capabilities.7.html

This is a limiting superset for the effective capabilities that the thread may assume. It is also a limiting superset for the capabilities that may be added to the inheritable set by a thread that does not have the CAP_SETPCAP capability in its effective set.

If a thread drops a capability from its permitted set, it can never reacquire that capability (unless it execve(2)s either a set-user-ID-root program, or a program whose associated file capabilities grant that capability).

cap_effective: Capabilities

From https://man7.org/linux/man-pages/man7/capabilities.7.html

This is the set of capabilities used by the kernel to perform permission checks for the thread.

cap_inheritable: Capabilities

From https://man7.org/linux/man-pages/man7/capabilities.7.html

This is a set of capabilities preserved across an execve(2). Inheritable capabilities remain inheritable when executing any program, and inheritable capabilities are added to the permitted set when executing a program that has the corresponding bits set in the file inheritable set.

Because inheritable capabilities are not generally preserved across execve(2) when running as a non-root user, applications that wish to run helper programs with elevated capabilities should consider using ambient capabilities, described below.

cap_bounding: Capabilities

From https://man7.org/linux/man-pages/man7/capabilities.7.html

The capability bounding set is a mechanism that can be used to limit the capabilities that are gained during execve(2).

Since Linux 2.6.25, this is a per-thread capability set. In older kernels, the capability bounding set was a system wide attribute shared by all threads on the system.

cap_ambient: Capabilities

From https://man7.org/linux/man-pages/man7/capabilities.7.html

This is a set of capabilities that are preserved across an execve(2) of a program that is not privileged. The ambient capability set obeys the invariant that no capability can ever be ambient if it is not both permitted and inheritable.

Executing a program that changes UID or GID due to the set-user-ID or set-group-ID bits or executing a program that has any file capabilities set will clear the ambient set.

securebits: SecureBits

From https://man7.org/linux/man-pages/man7/capabilities.7.html

Starting with kernel 2.6.26, and with a kernel in which file capabilities are enabled, Linux implements a set of per-thread securebits flags that can be used to disable special handling of capabilities for UID 0 (root).

The securebits flags can be modified and retrieved using the prctl(2) PR_SET_SECUREBITS and PR_GET_SECUREBITS operations. The CAP_SETPCAP capability is required to modify the flags.

Implementations

impl Credentials

pub fn root() -> Self

Creates a set of credentials with all possible permissions and capabilities.

pub fn with_ids(uid: uid_t, gid: gid_t) -> Credentials

Creates a set of credentials with the given uid and gid. If the uid is 0, the credentials will grant superuser access.

pub fn is_superuser(&self) -> bool

pub fn is_in_group(&self, gid: gid_t) -> bool

pub fn has_capability(&self, capability: Capabilities) -> bool

Returns whether or not the task has the given capability.

pub fn exec(&mut self, maybe_set: UserAndOrGroupId)

pub fn as_fscred(&self) -> FsCred

pub fn euid_as_fscred(&self) -> FsCred

pub fn uid_as_fscred(&self) -> FsCred

pub fn copy_user_credentials(&self) -> UserCredentials

pub fn update_capabilities(&mut self, prev: UserCredentials)

Trait Implementations

impl Clone for Credentials

fn clone(&self) -> Credentials

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Credentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<Credentials> for FsCred

fn from(c: Credentials) -> Self

Converts to this type from the input type.