Abhishekmishra2808 opened a new pull request, #19585:
URL: https://github.com/apache/nuttx/pull/19585
## Summary
This change closes a symlink TOCTOU race in the pseudo-filesystem and
hardens setuid/setgid exec identity handling. Parent-directory permission
checks are performed inside inode_reserve() and inode_remove() while the inode
tree lock is held, and that lock is kept across pseudorename, so a symlink
cannot be swapped between the check and the mutation. On setuid/setgid exec,
saved set-IDs are updated, the task group is marked secure, unsafe environment
variables are sanitized, and debug/dumpable state is cleared. Support is also
added for issetugid(), secure_getenv(), and PR_SET_DUMPABLE / PR_GET_DUMPABLE,
gated on CONFIG_SCHED_USER_IDENTITY.
## Impact
Configs that enable CONFIG_FS_PERMISSION and CONFIG_PSEUDOFS_SOFTLINKS now
enforce directory permissions under the inode lock, which closes the previous
check-then-act window around symlink targets. Configs with
CONFIG_SCHED_USER_IDENTITY get stricter setuid/setgid exec behavior, including
saved-ID updates, environment sanitization, and dumpable/secure flag handling.
When those options are disabled there is no intended behavior change, and stock
sim:nsh still builds. Applications that previously relied on inheriting
variables such as PATH or LD_* across a setuid exec may see those cleared; that
is intentional.
## Testing
multiuser_test completed with 0 failures, covering UID/GID switching,
saved-set child semantics, pseudoFS and tmpfs permission enforcement, and
passwd lookup after credential drop. Full ostest exited with status 0.
```
user_main: multi-user test
multiuser_test: start
multiuser: effective UID/GID switching
PASS: initial uid == 0
PASS: initial euid == 0
PASS: initial gid == 0
PASS: initial egid == 0
PASS: root seteuid(1000)
PASS: euid after seteuid(1000) == 1000
PASS: root seteuid(0) restore
PASS: euid restored to 0 == 0
PASS: root setegid(2000)
PASS: egid after setegid(2000) == 2000
PASS: root setegid(0) restore
PASS: egid restored to 0 == 0
multiuser: saved set-UID/GID semantics (child task)
multiuser_suid_child: saved set-UID/GID semantics
PASS: setuid(1000) as root
PASS: uid after setuid(1000) == 1000
PASS: euid after setuid(1000) == 1000
PASS: non-root seteuid(0) denied errno=1
PASS: euid unchanged after denied seteuid(0) == 1000
PASS: non-root seteuid(1000)
PASS: root-group setegid(2000)
PASS: egid after setegid(2000) == 2000
PASS: root-group setegid(0) restore
PASS: setgid(3000)
PASS: gid after setgid(3000) == 3000
PASS: egid after setgid(3000) == 3000
PASS: non-root setegid(0) denied errno=1
PASS: egid unchanged after denied setegid(0) == 3000
multiuser_suid_child: 0 failure(s)
PASS: mu_suid child completed successfully
PASS: parent euid after child == 0
PASS: parent egid after child == 0
multiuser: pseudoFS chmod/chown/open permissions
PASS: /ostest_mu_perm owner 0:0
PASS: root chmod(0600)
PASS: non-owner chmod(0777) denied errno=1
PASS: non-root chown(0,0) denied errno=1
PASS: root chown to 1000:1000
PASS: /ostest_mu_perm owner 1000:1000
PASS: owner chmod(0777)
PASS: /ostest_mu_secret owner 0:0
PASS: open(/ostest_mu_secret) denied with EACCES
PASS: open(/ostest_mu_secret) allowed
PASS: /ostest_mu_user owner 1000:1000
PASS: open(/ostest_mu_user) allowed
multiuser: tmpfs open permission enforcement
PASS: /tmp/ostest_mu_secret owner 0:0
PASS: open(/tmp/ostest_mu_secret) denied with EACCES
PASS: open(/tmp/ostest_mu_secret) allowed
multiuser: passwd lookup after credential drop
PASS: provisioned /tmp/ostest_passwd
PASS: getpwnam(root) uid=0
PASS: getpwnam(testuser) uid=1000
multiuser_test: 0 failure(s)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
