copy_to_user(userspace_address, kernel_address, length);
copy_from_user(kernel_address, userspace_address, length);

struct task_struct {
    struct thread_info    	thread_info;

    /* -1 unrunnable, 0 runnable, >0 stopped: */
    volatile long         	state;

    void                  	*stack;
    atomic_t              	usage;
	// ...
    int                   	prio;
    int                   	static_prio;
    int                   	normal_prio;
    unsigned int          	rt_priority;

    struct sched_info     	sched_info;

    struct list_head      	tasks;

    pid_t                 	pid;
    pid_t                 	tgid;

    /* Process credentials: */

    /* Objective and real subjective task credentials (COW): */
    const struct cred __rcu  *real_cred;

    /* Effective (overridable) subjective task credentials (COW): */
    const struct cred __rcu  *cred;
	// ...
};

struct cred {
    atomic_t    usage;
    kuid_t   	 uid;   	 /* real UID of the task */
    kgid_t   	 gid;   	 /* real GID of the task */
    kuid_t   	 suid;   	 /* saved UID of the task */
    kgid_t   	 sgid;   	 /* saved GID of the task */
    kuid_t   	 euid;   	 /* effective UID of the task */
    kgid_t   	 egid;   	 /* effective GID of the task */
    kuid_t   	 fsuid;   	 /* UID for VFS ops */
    kgid_t   	 fsgid;   	 /* GID for VFS ops */
    unsigned    securebits;    /* SUID-less security management */
    kernel_cap_t    cap_inheritable; /* caps our children can inherit */
    kernel_cap_t    cap_permitted;    /* caps we're permitted */
    kernel_cap_t    cap_effective;    /* caps we can actually use */
    kernel_cap_t    cap_bset;    /* capability bounding set */
    kernel_cap_t    cap_ambient;    /* Ambient capability set */
	// ...
};

//准备一个cred结构体，当输入为0时，它返回一个root权限的cred！
struct cred * prepare_kernel_cred(struct task_struct *reference_task_struct)

//将获得的root cred提交，进程就会获得root权限
commit_creds(struct cred *)

//即，只要运行 commit_creds(prepare_kernel_cred(0));就能获得root权限！
//当然，内核还维护了一个初始结构体`init_cred`,即commit_creds(init_cred);也能获得root权限！

//回顾 ## 2.1 内核标识进程权限的结构体 章节中，task_struct有一个thread_info结构体
struct task_struct {
    struct thread_info    	thread_info;
}

struct thread_info {
    unsigned long flags;	/* low level flags */
    u32 status;		/* thread synchronous flags */
};

/*
	 * Handle seccomp.  regs->ip must be the original value.
	 * See seccomp_send_sigsys and Documentation/userspace-api/seccomp_filter.rst.
	 *
	 * We could optimize the seccomp disabled case, but performance
	 * here doesn't matter.
	 */
	regs->orig_ax = syscall_nr;
	regs->ax = -ENOSYS;
	tmp = secure_computing();
	if ((!tmp && regs->orig_ax != syscall_nr) || regs->ip != address) {
		warn_bad_vsyscall(KERN_DEBUG, regs,
				  "seccomp tried to change syscall nr or ip");
		do_exit(SIGSYS);
	}

static inline int secure_computing(void)
{
	if (unlikely(test_thread_flag(TIF_SECCOMP)))//关键函数，如果TIF_SECCOMP没有被设置，说明没有seccomp机制
		return  __secure_computing(NULL);
	return 0;
}
int __secure_computing(const struct seccomp_data *sd)
{
	// lots of stuff, then...

	this_syscall = sd ? sd->nr : syscall_get_nr(current, task_pt_regs(current));

	switch (mode) {
		case SECCOMP_MODE_STRICT:
			__secure_computing_strict(this_syscall);  /* may call do_exit */
			return 0;
		case SECCOMP_MODE_FILTER:
			return __seccomp_filter(this_syscall, sd, false);
		default:
			BUG();
	}
}

current_task_struct->thread_info.flags &= ~(1 << TIF_SECCOMP)
//The kernel points the segment register gs to the current task struct.
//所以gs寄存器指向current task struct