Abhishekmishra2808 opened a new pull request, #3728: URL: https://github.com/apache/nuttx-apps/pull/3728
*Note: Please adhere to [Contributing Guidelines](https://github.com/apache/nuttx/blob/master/CONTRIBUTING.md).* ## Summary This adds a small UNIX-style `sudo` program under `system/sudo`. Privilege comes from the setuid bit on exec (file owner UID 0 via `nx_uid`/`nx_mode`), not from a new kernel API. After exec, `sudo` identifies the caller with `getuid()`, checks the password with `passwd_verify()`, becomes fully root with `setresuid`/`setresgid`/`initgroups`, and `execvp()`s the requested command. Ostest covers setuid exec after a hard `setuid()` drop (`sudo --probe`). ## Impact Enable `CONFIG_SYSTEM_SUDO` (depends on `SCHED_USER_IDENTITY`, `LIBC_PASSWD_FILE`, `FSUTILS_PASSWD`, and `LIBC_EXECFUNCS`) to install `/bin/sudo` as `-rwsr-xr-x` root. NSH does not gain a builtin `sudo`; the helper is a normal file application. There is no sudoers/PAM policy in this PR. Kernel docs for the command are in a matching nuttx PR. ## Testing Host: Linux x86_64 (WSL2), gcc 13.3.0. Target: `sim:login` with `CONFIG_SCHED_USER_IDENTITY=y`, `CONFIG_SYSTEM_SUDO=y`, `CONFIG_LIBC_EXECFUNCS=y`, `CONFIG_FSUTILS_PASSWD=y`. Build completed (`CC: sudo_main.c`, `LD: nuttx`). Runtime: ``` login: root password: User Logged-in! NuttShell (NSH) NuttX-13.0.0 nsh# id uid=0(root) gid=0(root) nsh# ls -l /bin/sudo -rwsr-xr-x root root 0 /bin/sudo nsh# /bin/hello Hello, World!! ``` On this flat `sim:login` + BINFS setup, `/bin/sudo` is a size-0 BINFS node with the setuid bit set. Executing it hangs because there is no real ELF to load (`CONFIG_ELF` is off). Non-setuid BINFS apps such as `/bin/hello` run normally. Full command execution needs a loadable ELF (`CONFIG_SYSTEM_SUDO=m` and `CONFIG_ELF`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
